joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434de0
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 8
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 4], eax
mov ecx, 2
call fcn.00434b80
cmp eax, 0xffffffff
je 0x434e1b
mov esi, eax
mov eax, esp
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0049f6f0
add esp, 8
pop esi
ret

Function at 0x435220
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [esp + 0x10]
test edx, edx
je 0x43526b
xor ecx, ecx
xor eax, eax
cmp edx, 2
setne cl
sete al
lea ecx, [ecx + ecx*2]
mov ebx, 0x40000000
mov edx, 0x80000000
cmove edx, ebx
mov ebx, eax
shl ebx, 7
xor eax, 3
push 0
push ebx
push eax
push 0
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi], eax
cmp eax, 0xffffffff
setne al
jmp 0x4352a7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x43529f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x43529f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043d3e0
add esp, 4
push eax
push esi
push str.Unable_to_delete__s:__s
call fcn.00406290
add esp, 0xc
mov dword [edi], 0xffffffff
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x43c200
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 4], eax
mov dword [esp], 0x105
mov ebx, 0x105
push 0
push 1
push 0x105
call fcn.004397d0
add esp, 0xc
mov esi, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, esp
nop
nop
nop
nop
nop
nop
nop
push ebx
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
call ebp
cmp eax, 0xea
jne 0x43c26e
push 0
push 1
push dword [esp + 8]
push 1
push edi
push esi
call fcn.00439870
add esp, 0x18
mov esi, eax
mov ebx, dword [esp]
jmp 0x43c240
test eax, eax
je 0x43c27d
push esi
call fcn.00439860
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43c2a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, dword [0x501034]
xor esi, esp
mov dword [esp + 8], esi
mov dword [esp], 4
mov esi, esp
lea edi, [esp + 4]
push esi
push edx
push edi
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
xor ecx, 4
or ecx, eax
mov eax, dword [esp + 4]
xor eax, 4
or eax, ecx
sete bl
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0049f6f0
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
ret

Function at 0x43c300
Capabilities:
Set registry value

Disassembly:
push ebx
push eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [0x501034]
xor edx, esp
mov dword [esp], edx
lea edx, [esp + 0x14]
push 4
push edx
push 4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov ecx, dword [esp]
xor ecx, esp
call fcn.0049f6f0
mov eax, ebx
add esp, 4
pop ebx
ret

Function at 0x43c340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 8], eax
mov ebx, esp
lea eax, [esp + 4]
push ebx
push 0
push eax
push 0
push dword [esp + 0x34]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x43c3df
cmp dword [esp + 4], 1
jne 0x43c3df
mov ebp, dword [esp]
add ebp, 1
push 0
push 1
push ebp
call fcn.004397d0
add esp, 0xc
mov ecx, edi
mov edi, eax
push ebx
push eax
lea eax, [esp + 0xc]
push eax
push 0
push dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43c3d6
cmp dword [esp + 4], 1
jne 0x43c3d6
mov eax, dword [esp]
cmp eax, ebp
jb 0x43c3ce
push 0x6c
push str._home_simon_mem_.build_workdirs_bob_u160jzna_putty_windows_utils_registry.c
push str.size___allocsize
call fcn.004aeeb3
add esp, 0xc
mov eax, dword [esp]
mov byte [edi + eax], 0
mov esi, edi
jmp 0x43c3df
push edi
call fcn.00439860
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c400
Capabilities:
Set registry value

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push ebx
call fcn.004b2d70
add esp, 4
add eax, 1
push eax
push ebx
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
pop esi
pop edi
pop ebx
ret

Function at 0x43c440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 8], eax
mov ebp, esp
lea ebx, [esp + 4]
push ebp
push 0
push ebx
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x43c4ec
cmp dword [esp + 4], 7
jne 0x43c4ec
call fcn.00439d90
mov edi, eax
mov eax, dword [esp]
add eax, 2
push eax
push edi
call fcn.00439cb0
add esp, 8
push ebp
push eax
push ebx
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43c4e3
cmp dword [esp + 4], 7
jne 0x43c4e3
push dword [esp]
push edi
call fcn.00439cf0
add esp, 8
nop
nop
nop
nop
nop
nop
push 0
push edi
call fcn.00439d60
add esp, 8
test al, al
jne 0x43c4c0
mov eax, edi
add eax, 0xc
push 0
push eax
call fcn.00439010
add esp, 8
mov esi, edi
jmp 0x43c4ec
push edi
call fcn.00439e50
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43c510
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 8]
add ecx, 1
push ecx
push dword [eax]
push 7
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
ret
Function at 0x43c920
Capabilities:
Link many functions at runtime

Disassembly:
cmp byte [0x5042c4], 1
jne 0x43c92f
mov al, byte [0x5042c5]
ret
mov byte [0x5042c4], 1
push str.advapi32.dll
call fcn.0043bfb0
add esp, 4
mov dword [0x5042c8], eax
test eax, eax
je 0x43ca77
push str.GetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5042cc], eax
test eax, eax
je 0x43ca77
mov eax, dword [0x5042c8]
test eax, eax
je 0x43ca3d
push str.SetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5042d0], eax
test eax, eax
je 0x43ca77
mov eax, dword [0x5042c8]
test eax, eax
je 0x43ca49
push str.OpenProcessToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5042d4], eax
test eax, eax
je 0x43ca77
mov eax, dword [0x5042c8]
test eax, eax
je 0x43ca55
push str.GetTokenInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5042d8], eax
test eax, eax
je 0x43ca77
mov eax, dword [0x5042c8]
test eax, eax
je 0x43ca61
push 0x4e237f
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5042dc], eax
test eax, eax
je 0x43ca77
mov eax, dword [0x5042c8]
test eax, eax
je 0x43ca6d
push 0x4e26af
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x5042e0], eax
xor eax, eax
test ecx, ecx
je 0x43ca79
mov ecx, dword [0x5042c8]
test ecx, ecx
je 0x43ca31
push str.SetEntriesInAclA
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5042e4], eax
test eax, eax
setne al
jmp 0x43ca79
mov dword [0x5042d0], 0
jmp 0x43ca77
mov dword [0x5042d4], 0
jmp 0x43ca77
mov dword [0x5042d8], 0
jmp 0x43ca77
mov dword [0x5042dc], 0
jmp 0x43ca77
mov dword [0x5042e0], 0
xor eax, eax
mov byte [0x5042c5], al
ret

Function at 0x43f600
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push esi
cmp byte [0x504370], 0
jne 0x43f6ee
push str.winspool.drv
call fcn.0043bfb0
add esp, 4
mov esi, eax
push str.spoolss.dll
call fcn.0043bfb0
add esp, 4
test esi, esi
je 0x43f69a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumPrintersA
push esi
call edi
mov dword [0x50436c], eax
push str.OpenPrinterA
push esi
call edi
mov dword [0x504350], eax
push str.ClosePrinter
push esi
call edi
mov dword [0x504364], eax
push str.StartDocPrinterA
push esi
call edi
mov dword [0x504354], eax
push str.EndDocPrinter
push esi
call edi
mov dword [0x504360], eax
push str.StartPagePrinter
push esi
call edi
mov dword [0x504358], eax
push str.EndPagePrinter
push esi
call edi
mov dword [0x50435c], eax
push str.WritePrinter
push esi
call edi
jmp 0x43f6e2
mov dword [0x50436c], 0
mov dword [0x504350], 0
mov dword [0x504364], 0
mov dword [0x504354], 0
mov dword [0x504360], 0
mov dword [0x504358], 0
mov dword [0x50435c], 0
xor eax, eax
mov dword [0x504368], eax
mov byte [0x504370], 1
pop esi
pop edi
ret
Function at 0x449ee0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov esi, dword [esp + 0x120]
mov edi, dword [esp + 0x11c]
mov al, byte [esp + 0x124]
mov ecx, dword [0x501034]
xor ecx, esp
mov dword [esp + 0x104], ecx
xor ebp, ebp
mov ebx, 0
test al, al
je 0x449f32
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xffffffff
cmp eax, 0x103
setb bl
mov al, byte [esp + 0x128]
mov dword [esi], 0x4c
test edi, edi
je 0x449f4b
xor ebp, ebp
cmp byte [edi], 0
cmovne ebp, edi
mov dword [esi + 0x2c], ebp
test al, al
je 0x449f5b
push esi
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x449f62
push esi
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov esi, eax
test edi, edi
je 0x449f83
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xfffffefc
cmp eax, 0xfffffefc
ja 0x449f83
mov byte [edi], 0
test bl, bl
je 0x449f90
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test esi, esi
setne bl
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0049f6f0
mov eax, ebx
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44d7c0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [esp + 0xc]
lea eax, [ecx - 1]
cmp eax, 0x15
jae 0x44d7da
mov edx, 0x18007f
bt edx, eax
jb 0x44d936
mov edx, dword [esp + 4]
cmp edx, 1
jne 0x44d7ee
mov eax, str.SSH2_MSG_KEXDH_INIT
cmp ecx, 0x1e
jne 0x44d7ee
ret
cmp edx, 1
jne 0x44d7fd
mov eax, str.SSH2_MSG_KEXDH_REPLY
cmp ecx, 0x1f
je 0x44d7ed
cmp edx, 2
jne 0x44d80c
mov eax, str.SSH2_MSG_KEX_DH_GEX_REQUEST_OLD
cmp ecx, 0x1e
je 0x44d7ed
cmp edx, 2
jne 0x44d81b
mov eax, str.SSH2_MSG_KEX_DH_GEX_REQUEST
cmp ecx, 0x22
je 0x44d7ed
cmp edx, 2
jne 0x44d82a
mov eax, str.SSH2_MSG_KEX_DH_GEX_GROUP
cmp ecx, 0x1f
je 0x44d7ed
cmp edx, 2
jne 0x44d839
mov eax, str.SSH2_MSG_KEX_DH_GEX_INIT
cmp ecx, 0x20
je 0x44d7ed
cmp edx, 2
jne 0x44d848
mov eax, str.SSH2_MSG_KEX_DH_GEX_REPLY
cmp ecx, 0x21
je 0x44d7ed
cmp edx, 4
jne 0x44d857
mov eax, str.SSH2_MSG_KEXGSS_INIT
cmp ecx, 0x1e
je 0x44d7ed
cmp edx, 4
jne 0x44d866
mov eax, str.SSH2_MSG_KEXGSS_CONTINUE
cmp ecx, 0x1f
je 0x44d7ed
cmp edx, 4
jne 0x44d879
mov eax, str.SSH2_MSG_KEXGSS_COMPLETE
cmp ecx, 0x20
je 0x44d7ed
cmp edx, 4
jne 0x44d88c
mov eax, str.SSH2_MSG_KEXGSS_HOSTKEY
cmp ecx, 0x21
je 0x44d7ed
cmp edx, 4
jne 0x44d89f
mov eax, str.SSH2_MSG_KEXGSS_ERROR
cmp ecx, 0x22
je 0x44d7ed
cmp edx, 4
jne 0x44d8b2
mov eax, str.SSH2_MSG_KEXGSS_GROUPREQ
cmp ecx, 0x28
je 0x44d7ed
cmp edx, 4
jne 0x44d8c5
mov eax, str.SSH2_MSG_KEXGSS_GROUP
cmp ecx, 0x29
je 0x44d7ed
cmp edx, 5
jne 0x44d8d8
mov eax, str.SSH2_MSG_KEXRSA_PUBKEY
cmp ecx, 0x1e
je 0x44d7ed
cmp edx, 5
jne 0x44d8eb
mov eax, str.SSH2_MSG_KEXRSA_SECRET
cmp ecx, 0x1f
je 0x44d7ed
cmp edx, 5
jne 0x44d8fe
mov eax, str.SSH2_MSG_KEXRSA_DONE
cmp ecx, 0x20
je 0x44d7ed
cmp edx, 3
jne 0x44d911
mov eax, str.SSH2_MSG_KEX_ECDH_INIT
cmp ecx, 0x1e
je 0x44d7ed
cmp edx, 3
jne 0x44d924
mov eax, str.SSH2_MSG_KEX_ECDH_REPLY
cmp ecx, 0x1f
je 0x44d7ed
lea eax, [ecx - 0x32]
cmp eax, 4
jae 0x44d940
lea eax, [eax*4 + 0x4d4f28]
mov eax, dword [eax]
ret
lea eax, [eax*4 + 0x4d4ed4]
mov eax, dword [eax]
ret
mov edx, dword [esp + 8]
cmp edx, 1
jne 0x44d957
mov eax, str.SSH2_MSG_USERAUTH_PK_OK
cmp ecx, 0x3c
je 0x44d7ed
cmp edx, 2
jne 0x44d96a
mov eax, str.SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ
cmp ecx, 0x3c
je 0x44d7ed
cmp edx, 4
jne 0x44d97d
mov eax, str.SSH2_MSG_USERAUTH_INFO_REQUEST
cmp ecx, 0x3c
je 0x44d7ed
cmp edx, 4
jne 0x44d990
mov eax, str.SSH2_MSG_USERAUTH_INFO_RESPONSE
cmp ecx, 0x3d
je 0x44d7ed
cmp edx, 3
jne 0x44d9a3
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_RESPONSE
cmp ecx, 0x3c
je 0x44d7ed
cmp edx, 3
jne 0x44d9b6
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_TOKEN
cmp ecx, 0x3d
je 0x44d7ed
cmp edx, 3
jne 0x44d9c9
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE
cmp ecx, 0x3f
je 0x44d7ed
cmp edx, 3
jne 0x44d9dc
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_ERROR
cmp ecx, 0x40
je 0x44d7ed
cmp edx, 3
jne 0x44d9ef
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_ERRTOK
cmp ecx, 0x41
je 0x44d7ed
cmp edx, 3
jne 0x44da02
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_MIC
cmp ecx, 0x42
je 0x44d7ed
add ecx, 0xffffffb0
mov eax, str.unknown
cmp ecx, 0x15
jae 0x44d7ed
lea eax, [ecx*4 + 0x4d4f38]
mov eax, dword [eax]
ret
Function at 0x463530
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
push 0x4e8bc8
push dword [eax]
call fcn.004b100b
add esp, 8
test eax, eax
je 0x4635a6
mov esi, eax
mov ebp, dword [esp + 0x14]
mov dword [ebp + 4], 0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4635bd
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
add eax, dword [ebp]
push esi
push ecx
push 1
push eax
call fcn.004b11a3
add esp, 0x10
mov edi, eax
push esi
call fcn.004b0a55
add esp, 4
test eax, eax
jne 0x4635ad
mov eax, dword [ebp + 4]
test edi, edi
je 0x4635b4
add eax, edi
mov dword [ebp + 4], eax
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x463570
jmp 0x4635b7
mov ebx, 2
jmp 0x4635f7
mov ebx, 2
jmp 0x4635ee
mov ecx, dword [ebp + 8]
xor ebx, ebx
cmp eax, ecx
jne 0x4635d1
push esi
call fcn.004b0dea
add esp, 4
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
lea edx, [ebp + 0xc]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], edx
push esi
call fcn.004b0900
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4673c0
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 4], eax
push 0
push 0x102c
push 1
call fcn.004397d0
add esp, 0xc
mov esi, eax
mov dword [eax], 0
lea edi, [eax + 4]
mov dword [eax + 4], ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x10], eax
mov dword [esi + 0x1028], ebx
mov byte [esi + 0x16], 0
mov word [esi + 0x14], 0
mov eax, dword [esp + 0x24]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x1c], eax
cmp dword [0x501060], 0xffffffff
jne 0x467473
mov dword [0x5043d8], 0x5043d8
mov dword [0x5043dc], 0x5043d8
push 0x5043e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x501060], eax
push 0
push 0x467b60
push eax
call fcn.00426280
add esp, 0xc
mov eax, esp
push eax
push 0
push edi
push 0x4674b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x467493
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 0x17], 1
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4676a0
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 4], eax
push 0
push 0x102c
push 1
call fcn.004397d0
add esp, 0xc
mov esi, eax
mov dword [eax], 1
lea edi, [eax + 4]
mov dword [eax + 4], ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], ebx
lea eax, [esi + 0x30]
push eax
call fcn.0043ef40
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esp + 0x20]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], esi
mov eax, dword [esp + 0x28]
mov dword [esi + 0x1c], eax
cmp dword [0x501060], 0xffffffff
jne 0x467763
mov dword [0x5043d8], 0x5043d8
mov dword [0x5043dc], 0x5043d8
push 0x5043e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x501060], eax
push 0
push 0x467b60
push eax
call fcn.00426280
add esp, 0xc
mov eax, esp
push eax
push 0
push edi
push 0x4677a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x467783
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x468350
Capabilities:
Get session user name

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 4], eax
cmp byte [0x5043fc], 0
je 0x468378
mov ecx, dword [0x5043f8]
test ecx, ecx
jne 0x4683bb
jmp 0x468408
push str.secur32.dll
call fcn.0043bfb0
add esp, 4
mov esi, eax
push str.sspicli.dll
call fcn.0043bfb0
add esp, 4
test esi, esi
je 0x4683a8
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x4683aa
xor ecx, ecx
mov dword [0x5043f8], ecx
mov byte [0x5043fc], 1
test ecx, ecx
je 0x468408
mov dword [esp], 0
mov edi, esp
push edi
push 0
push 8
call ecx
push 0
push 1
push dword [esp + 8]
call fcn.004397d0
add esp, 0xc
mov esi, eax
push edi
push eax
push 8
call dword [0x5043f8]
test al, al
je 0x4683ff
push 0x40
push esi
call fcn.004a25b0
add esp, 8
test eax, eax
je 0x468455
mov byte [eax], 0
jmp 0x468455
push esi
call fcn.00439860
add esp, 4
mov dword [esp], 0
mov edi, esp
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x468423
mov eax, dword [esp]
jmp 0x46842f
mov dword [esp], 0x100
mov eax, 0x100
push 0
push 1
push eax
call fcn.004397d0
add esp, 0xc
mov esi, eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x468455
push esi
call fcn.00439860
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 8
pop esi
pop edi
ret

Function at 0x468810
Capabilities:
Get common file path

Disassembly:
push esi
cmp dword [0x504400], 0
jne 0x468870
push dword [0x504404]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, dword [0x504404]
jb 0x468870
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 1
push eax
push 1
push 0x504404
push dword [0x504400]
call fcn.00439870
add esp, 0x18
mov dword [0x504400], eax
push dword [0x504404]
push eax
call esi
cmp eax, dword [0x504404]
jae 0x468840
mov eax, dword [0x504400]
pop esi
ret

Function at 0x46a560
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
cmp eax, dword [esi]
je 0x46a58d
push 0xa6
push str._home_simon_mem_.build_workdirs_bob_u160jzna_putty_crypto_mpint.c
push str.x0__nw__x1__nw
call fcn.004aeeb3
add esp, 0xc
and ebx, 1
neg ebx
mov dword [esp], ebx
cmp dword [edi], 0
je 0x46a5c4
xor eax, eax
nop
nop
nop
nop
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esp]
and ecx, edx
mov edx, dword [edi + 4]
xor dword [edx + eax*4], ecx
mov edx, dword [esi + 4]
xor dword [edx + eax*4], ecx
add eax, 1
cmp eax, dword [edi]
jb 0x46a5a0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x471a10
Capabilities:
Create pipe
Create process on windows
Create reverse shell

Disassembly:
push edi
push esi
sub esp, 0x7c
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x78], eax
mov dword [esp + 0x54], 0xc
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 1
lea esi, [esp + 0x54]
lea eax, [esp + 0x68]
lea ecx, [esp + 0x6c]
push 0
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x471bc5
lea eax, [esp + 0x74]
lea ecx, [esp + 0x70]
push 0
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x471b95
lea eax, [esp + 0x60]
lea ecx, [esp + 0x64]
push 0
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x471ba7
mov esi, dword [esp + 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 1
push dword [esp + 0x7c]
call edi
push 0
push 1
push dword [esp + 0x74]
call edi
mov eax, dword [esp + 0x64]
test eax, eax
je 0x471ac1
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov edi, dword [esp + 0x88]
mov dword [esp + 0x10], 0x44
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x3c], 0x100
mov word [esp + 0x42], 0
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x50], eax
push esi
call fcn.0043ef00
add esp, 4
mov esi, eax
mov eax, esp
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push 0x8000020
push 1
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
call fcn.00439860
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp]
call esi
push dword [esp + 4]
call esi
push dword [esp + 0x70]
call esi
push dword [esp + 0x68]
call esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x471b77
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push dword [esp + 0x68]
push dword [esp + 0x74]
push dword [esp + 0x80]
push edi
call fcn.004912f0
add esp, 0x14
xor esi, esi
jmp 0x471be4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x6c]
call esi
push dword [esp + 0x68]
jmp 0x471bc3
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x6c]
call esi
push dword [esp + 0x68]
call esi
push dword [esp + 0x74]
call esi
push dword [esp + 0x70]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043d3e0
add esp, 4
push eax
push str.Unable_to_create_pipes_for_proxy_command:__s
call fcn.00438d90
add esp, 8
mov esi, eax
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 0x7c
pop esi
pop edi
ret