joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ae0
Capabilities:
Get file size

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov ecx, dword [0x4c2010]
xor ecx, esp
mov dword [esp + 0x10], ecx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x406bb7
mov edi, eax
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x2c]
push 0
push 4
push 1
call fcn.004143e0
add esp, 0xc
mov esi, eax
mov dword [eax], edi
test ebx, ebx
je 0x406b4b
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 8]
mov dword [ebx + 4], ecx
mov dword [ebx], eax
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
or eax, ebp
je 0x406bab
mov eax, esp
lea ecx, [esp + 8]
push eax
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test ebp, ebp
je 0x406b88
push 0
push 0x989680
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.0046efe0
add eax, 0x49ef6f00
mov dword [ebp], eax
mov edi, dword [esp + 0x30]
test edi, edi
je 0x406bab
push 0
push 0x989680
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0046efe0
add eax, 0x49ef6f00
mov dword [edi], eax
test ebx, ebx
je 0x406bb9
mov dword [ebx], 0xffffffff
jmp 0x406bb9
xor esi, esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406bd0
Capabilities:
Read file on windows

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov esi, dword [0x4c2010]
xor esi, esp
mov dword [esp + 4], esi
mov esi, esp
push 0
push esi
push edx
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
sbb esi, esi
or esi, dword [esp]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 8
pop esi
ret

Function at 0x406c80
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov esi, dword [0x4c2010]
xor esi, esp
mov dword [esp + 4], esi
mov esi, esp
push 0
push esi
push edx
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [esp]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 8
pop esi
ret

Function at 0x406d50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
and ecx, 0x10
cmp ecx, 1
mov edx, 2
sbb edx, 0
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, edx
mov eax, ecx
ret
Function at 0x406f20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push esi
sub esp, 0x144
mov edi, dword [esp + 0x150]
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x140], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, 1
cmp eax, 0xffffffff
jne 0x406f6d
mov eax, esp
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x406f6b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 2
jmp 0x406f6d
xor esi, esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 0x144
pop esi
pop edi

Function at 0x4072b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x114
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x110], eax
cmp dword [0x4c2d28], 0
je 0x407317
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0
lea eax, [esp + 0xc]
push eax
push 0x407270
push 0x407290
call fcn.00417240
add esp, 0xc
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.00417630
mov esi, 0xffffffff
cmp eax, 0xffffffff
je 0x4072fc
mov edi, eax
push eax
call fcn.00411f40
add esp, 4
test al, al
je 0x407348
push 2
push edi
call fcn.004118c0
add esp, 8
lea ebp, [esp + 8]
lea esi, [esp + 0xc]
push ebp
push ebx
call fcn.00417860
add esp, 8
mov ecx, 0
test al, al
je 0x4073a9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 8]
mov edx, ecx
sub ecx, eax
sub eax, ebx
sub edx, ebx
cmp eax, edx
mov eax, 0
cmova ecx, eax
mov eax, ecx
mov edx, 0x10624dd3
imul edx
mov eax, edx
shr eax, 0x1f
sar edx, 6
add edx, eax
mov dword [esp], edx
imul eax, edx, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [esp + 4], eax
mov ecx, esp
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 1
push ecx
push 0
push 0
push esi
push 1
call dword [0x4c2d2c]
test eax, eax
js 0x4073cf
jne 0x4073d9
mov ebx, dword [esp + 8]
jmp 0x407350
mov esi, 0xffffffff
jmp 0x4072fc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 1
push edi
call fcn.004118c0
add esp, 8
xor esi, esi
jmp 0x4072fc
Function at 0x40c860
Capabilities:
Get session user name

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x3a
push esi
call fcn.00412de0
add esp, 8
cmp byte [eax], 0
je 0x40c880
push eax
call fcn.00413af0
add esp, 4
pop esi
ret
push 0x3b
push esi
call fcn.00412be0
add esp, 8
test al, al
je 0x40c895
pop esi
jmp fcn.00415440
xor eax, eax
pop esi
ret
Function at 0x415440
Capabilities:
Get session user name

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 4], eax
cmp byte [0x4c3404], 0
je 0x415468
mov ecx, dword [0x4c3400]
test ecx, ecx
jne 0x4154ab
jmp 0x4154f8
push str.secur32.dll
call fcn.004327c0
add esp, 4
mov esi, eax
push str.sspicli.dll
call fcn.004327c0
add esp, 4
test esi, esi
je 0x415498
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x41549a
xor ecx, ecx
mov dword [0x4c3400], ecx
mov byte [0x4c3404], 1
test ecx, ecx
je 0x4154f8
mov dword [esp], 0
mov edi, esp
push edi
push 0
push 8
call ecx
push 0
push 1
push dword [esp + 8]
call fcn.004143e0
add esp, 0xc
mov esi, eax
push edi
push eax
push 8
call dword [0x4c3400]
test al, al
je 0x4154ef
push 0x40
push esi
call fcn.00471e30
add esp, 8
test eax, eax
je 0x415545
mov byte [eax], 0
jmp 0x415545
push esi
call fcn.00414470
add esp, 4
mov dword [esp], 0
mov edi, esp
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x415513
mov eax, dword [esp]
jmp 0x41551f
mov dword [esp], 0x100
mov eax, 0x100
push 0
push 1
push eax
call fcn.004143e0
add esp, 0xc
mov esi, eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x415545
push esi
call fcn.00414470
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 8
pop esi
pop edi
ret
Function at 0x417860
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push edi
push esi
cmp dword [0x4c3420], 0
jne 0x41789b
push 0x4179b0
call fcn.004158c0
add esp, 4
mov dword [0x4c3420], eax
push 0x417a10
call fcn.004158c0
add esp, 4
mov dword [0x4c3424], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c341c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c341c], eax
push 0
push dword [0x4c3420]
call fcn.00416050
add esp, 8
test eax, eax
je 0x417949
mov esi, eax
mov edi, dword [esp + 0x14]
jmp 0x4178ff
push 0
push dword [0x4c3420]
call fcn.00416660
add esp, 8
push esi
call fcn.00414470
add esp, 4
push 0
push dword [0x4c3420]
call fcn.00416050
add esp, 8
mov esi, eax
test eax, eax
je 0x417949
push 0
push dword [esi + 4]
push dword [0x4c3424]
call fcn.00416620
add esp, 0xc
test eax, eax
je 0x4178d0
mov ecx, dword [0x4c341c]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
add edx, 0xfffffff6
sub ecx, edx
mov ebx, eax
sub ebx, edx
cmp ecx, ebx
jbe 0x41794d
push 0
push dword [0x4c3420]
call fcn.00416660
add esp, 8
push dword [esi + 8]
push dword [esi + 4]
call dword [esi]
jmp 0x4178dd
xor eax, eax
jmp 0x417951
mov dword [edi], eax
mov al, 1
pop esi
pop edi
pop ebx
ret

Function at 0x417b00
Capabilities:
Link many functions at runtime

Disassembly:
cmp byte [0x4c3428], 1
jne 0x417b0f
mov al, byte [0x4c3429]
ret
mov byte [0x4c3428], 1
push str.advapi32.dll
call fcn.004327c0
add esp, 4
mov dword [0x4c342c], eax
test eax, eax
je 0x417c57
push str.GetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c3430], eax
test eax, eax
je 0x417c57
mov eax, dword [0x4c342c]
test eax, eax
je 0x417c1d
push str.SetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c3434], eax
test eax, eax
je 0x417c57
mov eax, dword [0x4c342c]
test eax, eax
je 0x417c29
push str.OpenProcessToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c3438], eax
test eax, eax
je 0x417c57
mov eax, dword [0x4c342c]
test eax, eax
je 0x417c35
push str.GetTokenInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c343c], eax
test eax, eax
je 0x417c57
mov eax, dword [0x4c342c]
test eax, eax
je 0x417c41
push 0x4a8d09
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c3440], eax
test eax, eax
je 0x417c57
mov eax, dword [0x4c342c]
test eax, eax
je 0x417c4d
push 0x4a8fbb
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x4c3444], eax
xor eax, eax
test ecx, ecx
je 0x417c59
mov ecx, dword [0x4c342c]
test ecx, ecx
je 0x417c11
push str.SetEntriesInAclA
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c3448], eax
test eax, eax
setne al
jmp 0x417c59
mov dword [0x4c3434], 0
jmp 0x417c57
mov dword [0x4c3438], 0
jmp 0x417c57
mov dword [0x4c343c], 0
jmp 0x417c57
mov dword [0x4c3440], 0
jmp 0x417c57
mov dword [0x4c3444], 0
xor eax, eax
mov byte [0x4c3429], al
ret
Function at 0x418ae0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x408
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x404], eax
mov ecx, 1
call fcn.00418b90
cmp eax, 0xffffffff
je 0x418b69
mov esi, eax
mov eax, esp
lea ebx, [esp + 4]
push 0
push eax
push 0x400
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418b62
mov eax, dword [esp]
test eax, eax
je 0x418b62
mov ebp, dword [esp + 0x41c]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
push ebx
call ebp
add esp, 8
push 0
lea eax, [esp + 4]
push eax
push 0x400
push ebx
push esi
call edi
test eax, eax
je 0x418b62
mov eax, dword [esp]
test eax, eax
jne 0x418b40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0046efa0
add esp, 0x408
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418b90
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, ecx
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x210], eax
push 0
push str.SoftwareSimonTathamPuTTY
push 0x80000001
push 0
push 0
call fcn.00432d70
add esp, 0x14
test eax, eax
je 0x418c07
mov ebx, eax
push str.RandSeedFile
push eax
call fcn.00432f50
add esp, 8
mov edi, eax
push ebx
call fcn.00432e40
add esp, 4
test edi, edi
je 0x418c07
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00418e40
add esp, 4
mov ebx, eax
push edi
call fcn.00414470
add esp, 4
test bl, bl
jne 0x418dbd
cmp byte [0x4c3464], 0
je 0x418c1f
mov ecx, dword [0x4c346c]
test ecx, ecx
jne 0x418c5c
jmp 0x418ced
push str.shell32.dll
call fcn.004327c0
add esp, 4
mov dword [0x4c3468], eax
test eax, eax
je 0x418c45
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x418c47
xor ecx, ecx
mov dword [0x4c346c], ecx
mov byte [0x4c3464], 1
test ecx, ecx
je 0x418ced
lea ebp, [esp + 0x10b]
push ebp
push 0
push 0
push 0x1c
push 0
call ecx
test eax, eax
js 0x418ca6
push 0
push str.PUTTY.RND
push ebp
call fcn.00413890
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00418e40
add esp, 4
mov ebx, eax
push edi
call fcn.00414470
add esp, 4
test bl, bl
jne 0x418dbd
push ebp
push 0
push 0
push 0x1a
push 0
call dword [0x4c346c]
test eax, eax
js 0x418ced
push 0
push str.PUTTY.RND
push ebp
call fcn.00413890
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00418e40
add esp, 4
mov ebx, eax
push edi
call fcn.00414470
add esp, 4
test bl, bl
jne 0x418dbd
lea eax, [esp + 0x10b]
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
push eax
push str.HOMEDRIVE
call ebp
mov edi, eax
lea ebx, [esp + 7]
push 0x104
push ebx
push str.HOMEPATH
call ebp
test edi, edi
jne 0x418d26
mov byte [esp + 0x10b], 0
cmp edi, 0x103
ja 0x418d73
cmp eax, 0x103
ja 0x418d73
test eax, eax
je 0x418d73
push 0
push str.PUTTY.RND
push ebx
lea ebp, [esp + 0x117]
push ebp
call fcn.00413890
add esp, 0x10
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00418e40
add esp, 4
mov ebx, eax
push edi
call fcn.00414470
add esp, 4
test bl, bl
jne 0x418dbd
jmp 0x418d7a
lea ebp, [esp + 0x10b]
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 0x104
jae 0x418dc2
push 0
push str.PUTTY.RND
push ebp
call fcn.00413890
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00418e40
add esp, 4
mov ebx, eax
push edi
call fcn.00414470
add esp, 4
test bl, bl
je 0x418dc2
mov esi, dword [esp]
jmp 0x418dc7
mov esi, 0xffffffff
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418df0
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 8
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 4], eax
mov ecx, 2
call fcn.00418b90
cmp eax, 0xffffffff
je 0x418e2b
mov esi, eax
mov eax, esp
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046efa0
add esp, 8
pop esi
ret

Function at 0x418e40
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [esp + 0x10]
test edx, edx
je 0x418e8b
xor ecx, ecx
xor eax, eax
cmp edx, 2
setne cl
sete al
lea ecx, [ecx + ecx*2]
mov ebx, 0x40000000
mov edx, 0x80000000
cmove edx, ebx
mov ebx, eax
shl ebx, 7
xor eax, 3
push 0
push ebx
push eax
push 0
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi], eax
cmp eax, 0xffffffff
setne al
jmp 0x418ec7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418ebf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x418ebf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00417110
add esp, 4
push eax
push esi
push str.Unable_to_delete__s:__s
call fcn.004076a0
add esp, 0xc
mov dword [edi], 0xffffffff
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x41c720
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [esp + 0xc]
lea eax, [ecx - 1]
cmp eax, 0x15
jae 0x41c73a
mov edx, 0x18007f
bt edx, eax
jb 0x41c896
mov edx, dword [esp + 4]
cmp edx, 1
jne 0x41c74e
mov eax, str.SSH2_MSG_KEXDH_INIT
cmp ecx, 0x1e
jne 0x41c74e
ret
cmp edx, 1
jne 0x41c75d
mov eax, str.SSH2_MSG_KEXDH_REPLY
cmp ecx, 0x1f
je 0x41c74d
cmp edx, 2
jne 0x41c76c
mov eax, str.SSH2_MSG_KEX_DH_GEX_REQUEST_OLD
cmp ecx, 0x1e
je 0x41c74d
cmp edx, 2
jne 0x41c77b
mov eax, str.SSH2_MSG_KEX_DH_GEX_REQUEST
cmp ecx, 0x22
je 0x41c74d
cmp edx, 2
jne 0x41c78a
mov eax, str.SSH2_MSG_KEX_DH_GEX_GROUP
cmp ecx, 0x1f
je 0x41c74d
cmp edx, 2
jne 0x41c799
mov eax, str.SSH2_MSG_KEX_DH_GEX_INIT
cmp ecx, 0x20
je 0x41c74d
cmp edx, 2
jne 0x41c7a8
mov eax, str.SSH2_MSG_KEX_DH_GEX_REPLY
cmp ecx, 0x21
je 0x41c74d
cmp edx, 4
jne 0x41c7b7
mov eax, str.SSH2_MSG_KEXGSS_INIT
cmp ecx, 0x1e
je 0x41c74d
cmp edx, 4
jne 0x41c7c6
mov eax, str.SSH2_MSG_KEXGSS_CONTINUE
cmp ecx, 0x1f
je 0x41c74d
cmp edx, 4
jne 0x41c7d9
mov eax, str.SSH2_MSG_KEXGSS_COMPLETE
cmp ecx, 0x20
je 0x41c74d
cmp edx, 4
jne 0x41c7ec
mov eax, str.SSH2_MSG_KEXGSS_HOSTKEY
cmp ecx, 0x21
je 0x41c74d
cmp edx, 4
jne 0x41c7ff
mov eax, str.SSH2_MSG_KEXGSS_ERROR
cmp ecx, 0x22
je 0x41c74d
cmp edx, 4
jne 0x41c812
mov eax, str.SSH2_MSG_KEXGSS_GROUPREQ
cmp ecx, 0x28
je 0x41c74d
cmp edx, 4
jne 0x41c825
mov eax, str.SSH2_MSG_KEXGSS_GROUP
cmp ecx, 0x29
je 0x41c74d
cmp edx, 5
jne 0x41c838
mov eax, str.SSH2_MSG_KEXRSA_PUBKEY
cmp ecx, 0x1e
je 0x41c74d
cmp edx, 5
jne 0x41c84b
mov eax, str.SSH2_MSG_KEXRSA_SECRET
cmp ecx, 0x1f
je 0x41c74d
cmp edx, 5
jne 0x41c85e
mov eax, str.SSH2_MSG_KEXRSA_DONE
cmp ecx, 0x20
je 0x41c74d
cmp edx, 3
jne 0x41c871
mov eax, str.SSH2_MSG_KEX_ECDH_INIT
cmp ecx, 0x1e
je 0x41c74d
cmp edx, 3
jne 0x41c884
mov eax, str.SSH2_MSG_KEX_ECDH_REPLY
cmp ecx, 0x1f
je 0x41c74d
lea eax, [ecx - 0x32]
cmp eax, 4
jae 0x41c8a0
lea eax, [eax*4 + 0x49a058]
mov eax, dword [eax]
ret
lea eax, [eax*4 + 0x49a004]
mov eax, dword [eax]
ret
mov edx, dword [esp + 8]
cmp edx, 1
jne 0x41c8b7
mov eax, str.SSH2_MSG_USERAUTH_PK_OK
cmp ecx, 0x3c
je 0x41c74d
cmp edx, 2
jne 0x41c8ca
mov eax, str.SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ
cmp ecx, 0x3c
je 0x41c74d
cmp edx, 4
jne 0x41c8dd
mov eax, str.SSH2_MSG_USERAUTH_INFO_REQUEST
cmp ecx, 0x3c
je 0x41c74d
cmp edx, 4
jne 0x41c8f0
mov eax, str.SSH2_MSG_USERAUTH_INFO_RESPONSE
cmp ecx, 0x3d
je 0x41c74d
cmp edx, 3
jne 0x41c903
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_RESPONSE
cmp ecx, 0x3c
je 0x41c74d
cmp edx, 3
jne 0x41c916
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_TOKEN
cmp ecx, 0x3d
je 0x41c74d
cmp edx, 3
jne 0x41c929
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE
cmp ecx, 0x3f
je 0x41c74d
cmp edx, 3
jne 0x41c93c
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_ERROR
cmp ecx, 0x40
je 0x41c74d
cmp edx, 3
jne 0x41c94f
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_ERRTOK
cmp ecx, 0x41
je 0x41c74d
cmp edx, 3
jne 0x41c962
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_MIC
cmp ecx, 0x42
je 0x41c74d
add ecx, 0xffffffb0
mov eax, str.unknown
cmp ecx, 0x15
jae 0x41c74d
lea eax, [ecx*4 + 0x49a068]
mov eax, dword [eax]
ret
Function at 0x431c00
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x270
mov edi, dword [esp + 0x284]
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x26c], eax
lea esi, [esp + 0x25]
push 0x107
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.004831a0
add esp, 4
mov word [esp + eax + 0x25], 0x2a5c
mov byte [esp + eax + 0x27], 0
lea ebx, [esp + 0x12c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x431c7a
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x140
push ebx
call edi
add esp, 8
push ebx
push esi
call ebp
test eax, eax
jne 0x431c60
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], eax
mov eax, esp
push 4
push eax
call edi
add esp, 8
lea esi, [esp + 5]
push 0x20
push esi
call fcn.00431af0
add esp, 8
test al, al
je 0x431cb3
push 0x20
push esi
call edi
add esp, 8
push 0x20
push esi
call fcn.00432100
add esp, 8
push edi
call fcn.00418ae0
add esp, 4
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.0046efa0
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x431ce0
Capabilities:
Get memory capacity

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x2c], eax
lea esi, [esp + 0x2c]
push 4
push esi
push 9
call fcn.00409d70
add esp, 0xc
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [esp + 0x2c], eax
push 4
push esi
push 0xa
call fcn.00409d70
add esp, 0xc
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov dword [esp + 0x2c], eax
push 4
push esi
push 0xb
call fcn.00409d70
add esp, 0xc
push 0x1cbf
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push 4
push eax
push 0xc
call fcn.00409d70
add esp, 0xc
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
push esi
push 0xd
call fcn.00409d70
add esp, 0xc
mov esi, esp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x20
push esi
push 6
call fcn.00409d70
add esp, 0xc
lea ebp, [esp + 0x48]
lea ebx, [esp + 0x40]
lea edi, [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea esi, [esp + 0x30]
push ebp
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0x20
push esi
push 0xe
call fcn.00409d70
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebp
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0x20
push esi
push 0xf
call fcn.00409d70
add esp, 0xc
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0046efa0
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432e50
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 4], eax
mov dword [esp], 0x105
mov ebx, 0x105
push 0
push 1
push 0x105
call fcn.004143e0
add esp, 0xc
mov esi, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, esp
nop
nop
nop
nop
nop
nop
nop
push ebx
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
call ebp
cmp eax, 0xea
jne 0x432ebe
push 0
push 1
push dword [esp + 8]
push 1
push edi
push esi
call fcn.00414480
add esp, 0x18
mov esi, eax
mov ebx, dword [esp]
jmp 0x432e90
test eax, eax
je 0x432ecd
push esi
call fcn.00414470
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x432ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, dword [0x4c2010]
xor esi, esp
mov dword [esp + 8], esi
mov dword [esp], 4
mov esi, esp
lea edi, [esp + 4]
push esi
push edx
push edi
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
xor ecx, 4
or ecx, eax
mov eax, dword [esp + 4]
xor eax, 4
or eax, ecx
sete bl
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0046efa0
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
ret

Function at 0x432f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
mov eax, dword [0x4c2010]
xor eax, esp
mov dword [esp + 8], eax
mov ebx, esp
lea eax, [esp + 4]
push ebx
push 0
push eax
push 0
push dword [esp + 0x34]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x432fef
cmp dword [esp + 4], 1
jne 0x432fef
mov ebp, dword [esp]
add ebp, 1
push 0
push 1
push ebp
call fcn.004143e0
add esp, 0xc
mov ecx, edi
mov edi, eax
push ebx
push eax
lea eax, [esp + 0xc]
push eax
push 0
push dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x432fe6
cmp dword [esp + 4], 1
jne 0x432fe6
mov eax, dword [esp]
cmp eax, ebp
jb 0x432fde
push 0x6c
push str._home_simon_mem_.build_workdirs_bob_0_vdcidh_putty_windows_utils_registry.c
push str.size___allocsize
call fcn.0047f4a4
add esp, 0xc
mov eax, dword [esp]
mov byte [edi + eax], 0
mov esi, edi
jmp 0x432fef
push edi
call fcn.00414470
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0046efa0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x433010
Capabilities:
Set registry value

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push ebx
call fcn.004831a0
add esp, 4
add eax, 1
push eax
push ebx
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
pop esi
pop edi
pop ebx
ret