joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edi, ecx
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
je 0x479e04
mov edx, dword [edi]
xor edx, dword [ecx]
mov ebp, dword [edi + 4]
xor ebp, dword [ecx + 4]
or ebp, edx
je 0x479e51
test ebx, ebx
jle 0x479e47
add ebx, esi
mov ebp, 0x4d61ac
nop
mov ecx, dword [edi]
mov edx, dword [edi + 4]
xor ecx, dword [esi]
xor edx, dword [esi + 4]
or edx, ecx
mov ecx, 0x4d61b0
cmove ecx, ebp
push 4
push ecx
push eax
call fcn.0047c000
add esp, 0xc
push 4
push 0x4d61b0
push eax
call fcn.0047c000
add esp, 0xc
add esi, 8
cmp esi, ebx
jb 0x479e10
test eax, eax
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push 4
push 0x4d61ac
push 0
call fcn.0047c000
add esp, 0xc
push 4
push 0x4d61b0
push eax
call fcn.0047c000
add esp, 0xc
test ebx, ebx
jg 0x479e08
jmp 0x479e47

Function at 0x47c000
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test ecx, ecx
je 0x47c06b
mov edx, dword [esp + 0x18]
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [edx + esi]
xor edi, eax
mov ebx, edi
and ebx, 0xf
shr edi, 4
imul eax, ebx, 0x11111044
xor eax, edi
imul ebp, ebx, 0x8840020
imul edi, ebx, 0x4220000
xor edi, ebp
xor edi, eax
and eax, 0xf
shr edi, 4
imul ebx, eax, 0x11111044
imul ebp, eax, 0x8840020
xor ebp, ebx
imul eax, eax, 0x4220000
xor eax, edi
xor eax, ebp
add esi, 1
cmp ecx, esi
jne 0x47c020
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x47c070
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x47c0dd
mov edx, dword [esp + 0x14]
xor esi, esi
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [edx + esi]
xor edi, eax
mov ebx, edi
and ebx, 0xf
shr edi, 4
imul eax, ebx, 0x11111044
xor eax, edi
imul ebp, ebx, 0x8840020
imul edi, ebx, 0x4220000
xor edi, ebp
xor edi, eax
and eax, 0xf
shr edi, 4
imul ebx, eax, 0x11111044
imul ebp, eax, 0x8840020
xor ebp, ebx
imul eax, eax, 0x4220000
xor eax, edi
xor eax, ebp
add esi, 1
cmp ecx, esi
jne 0x47c090
jmp 0x47c0df
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47e480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov dword [esp + 0xc], edx
mov ebp, dword [esp + 0xa8]
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x88], eax
push ecx
mov dword [esp + 0xc], ecx
call dword [ecx]
add esp, 4
mov esi, eax
test eax, eax
je 0x47e4bc
mov eax, dword [esi]
push esi
call dword [eax + 4]
add esp, 4
mov dword [esp], esi
test ebp, ebp
jle 0x47e5d3
mov esi, dword [esp + 0xa4]
mov dword [esp + 4], 0
jmp 0x47e4f3
add dword [esp + 4], 1
add esi, edi
mov ebp, dword [esp + 0x10]
sub ebp, edi
jle 0x47e5d3
mov ebx, dword [esp + 8]
mov edi, dword [ebx + 0x14]
cmp ebp, edi
mov dword [esp + 0x10], ebp
cmovbe edi, ebp
mov ebp, dword [esp]
mov eax, dword [ebp]
push ebp
call dword [eax + 4]
add esp, 4
cmp dword [ebx + 0x14], 0x73
jb 0x47e52d
push 0x3c0
push str._home_simon_mem_.build_workdirs_bob_u160jzna_putty_crypto_rsa.c
push str.h__hlen___MAX_HASH_LEN
call fcn.004aeeb3
add esp, 0xc
push dword [esp + 0xa0]
push dword [esp + 0x10]
push dword [ebp + 4]
call fcn.00438f90
add esp, 0xc
push dword [esp + 4]
push dword [ebp + 4]
call fcn.004390c0
add esp, 8
mov eax, dword [ebp]
lea ecx, [esp + 0x16]
push ecx
push ebp
call dword [eax + 0xc]
add esp, 8
test edi, edi
jle 0x47e4e0
lea edx, [edi - 1]
mov eax, edi
and eax, 3
xor ecx, ecx
cmp edx, 3
jb 0x47e5aa
mov edx, edi
and edx, 0xfffffffc
xor ecx, ecx
nop
movzx ebx, byte [esp + ecx + 0x16]
xor byte [esi + ecx], bl
movzx ebx, byte [esp + ecx + 0x17]
xor byte [esi + ecx + 1], bl
movzx ebx, byte [esp + ecx + 0x18]
xor byte [esi + ecx + 2], bl
movzx ebx, byte [esp + ecx + 0x19]
xor byte [esi + ecx + 3], bl
add ecx, 4
cmp edx, ecx
jne 0x47e580
test eax, eax
je 0x47e4e0
lea edx, [esi + ecx]
add ecx, esp
add ecx, 0x16
xor ebp, ebp
nop
nop
nop
nop
movzx ebx, byte [ecx + ebp]
xor byte [edx + ebp], bl
add ebp, 1
cmp eax, ebp
jne 0x47e5c0
jmp 0x47e4e0
mov ecx, dword [esp]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x10]
add esp, 4
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.0049f6f0
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47fd10
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edi, dword [ecx + eax*4]
mov esi, edx
rol esi, 4
xor esi, dword [ecx + eax*4 + 0x40]
mov dword [esp + 0x1c], edx
xor edi, edx
mov eax, esi
and eax, 0xfc00fc
or eax, 0xff00ff00
mov dword [esp], eax
shr esi, 8
and esi, 0xfc00fc
or esi, 0xff00ff00
mov dword [esp + 8], esi
mov eax, edi
and eax, 0xfc00fc
or eax, 0xff00ff00
mov dword [esp + 4], eax
shr edi, 8
and edi, 0xfc00fc
or edi, 0xff00ff00
mov dword [esp + 0xc], edi
xor edi, edi
mov edx, 0x4d6a98
xor esi, esi
mov dword [esp + 0x10], 0
xor ecx, ecx
nop
nop
nop
mov dword [esp + 0x14], edi
mov edi, dword [edx]
mov eax, dword [esp]
and edi, eax
xor ecx, edi
mov edi, dword [edx + 4]
mov ebx, dword [esp + 8]
and edi, ebx
xor dword [esp + 0x10], edi
mov edi, dword [edx + 8]
mov ebp, dword [esp + 4]
and edi, ebp
xor esi, edi
mov dword [esp + 0x20], esi
mov edi, dword [edx + 0xc]
mov esi, dword [esp + 0xc]
and edi, esi
xor dword [esp + 0x14], edi
mov edi, dword [esp + 0x14]
add eax, 0x80008
mov dword [esp], eax
add ebx, 0x80008
mov dword [esp + 8], ebx
add ebp, 0x80008
mov dword [esp + 4], ebp
add esi, 0x80008
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x20]
add edx, 0x10
cmp edx, 0x4d6c98
jb 0x47fd90
mov edx, ecx
shl edx, 4
mov eax, dword [esp]
and eax, 0x40004
imul ebp, eax, 0x3c00
and ebp, edx
xor ebp, ecx
mov ecx, dword [esp + 0x10]
mov eax, ecx
shl eax, 4
mov edx, dword [esp + 8]
and edx, 0x40004
imul edx, edx, 0x3c00
and edx, eax
xor edx, ecx
mov ecx, esi
shl ecx, 4
mov eax, dword [esp + 4]
and eax, 0x40004
imul eax, eax, 0x3c00
and eax, ecx
xor eax, esi
mov esi, edi
shl esi, 4
mov ecx, dword [esp + 0xc]
and ecx, 0x40004
imul ecx, ecx, 0x3c00
and ecx, esi
xor ecx, edi
shr edx, 4
and edx, 0xf000f00
shr eax, 8
and eax, 0xf000f0
or eax, edx
and ecx, 0xf000f000
shr ebp, 0xc
and ebp, 0xf000f
or eax, ecx
or ebp, eax
shr eax, 4
xor eax, ebp
and eax, 0x7030702
xor ebp, eax
shl eax, 4
xor eax, ebp
mov ecx, eax
shr ecx, 8
xor ecx, ebp
and ecx, 0x4e009e
xor eax, ecx
shl ecx, 8
xor ecx, eax
mov edx, ecx
shr edx, 0x10
xor edx, ecx
and edx, 0xd9d3
xor ecx, edx
shl edx, 0x10
xor edx, ecx
mov eax, edx
shr eax, 4
xor eax, edx
and eax, 0x5040004
mov ecx, eax
shl eax, 4
xor eax, dword [esp + 0x18]
xor ecx, edx
shr edx, 1
xor edx, ecx
xor eax, ecx
and edx, 0x4045015
xor eax, edx
add edx, edx
xor edx, eax
mov eax, dword [esp + 0x1c]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48e7d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x54]
imul eax, dword [esp + 0x24], 0x3e8
mov ecx, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp], edx
mov edi, 1
mov ebx, 1
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], ebx
mov ebx, edi
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov edi, eax
mov ebp, esi
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push ebx
push dword [esp + 0x50]
push dword [esp + 0x50]
call fcn.0048dbc0
add esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
mov edi, dword [esp + 4]
add edi, ebx
setb cl
cmp eax, dword [esp]
jae 0x48e874
test cl, cl
jne 0x48e874
push 0
mov esi, ebp
push ebp
call fcn.00439cf0
add esp, 8
jmp 0x48e800
mov eax, dword [esp + 0x28]
mov dword [eax], ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48e890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc08
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x501034]
xor ecx, ebp
mov dword [esp + 0xc00], ecx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [eax + ecx*8]
mov ebx, dword [eax + ecx*8 + 4]
xor edi, dword [edx + ecx*8]
xor ebx, dword [edx + ecx*8 + 4]
mov dword [esp + ecx*8 + 0x804], ebx
mov dword [esp + ecx*8 + 0x800], edi
add ecx, 1
cmp ecx, 0x80
jne 0x48e8c0
lea eax, [esp + 0x800]
lea edi, [esp + 0x400]
mov ecx, edi
mov edx, 2
push 2
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0x880]
lea ecx, [esp + 0x480]
mov edx, 2
push 2
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0x900]
lea ecx, [esp + 0x500]
mov edx, 2
push 2
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0x980]
lea ecx, [esp + 0x580]
mov edx, 2
push 2
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0xa00]
lea ecx, [esp + 0x600]
mov edx, 2
push 2
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0xa80]
lea ecx, [esp + 0x680]
mov edx, 2
push 2
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0xb00]
lea ecx, [esp + 0x700]
mov edx, 2
push 2
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0xb80]
lea ecx, [esp + 0x780]
mov edx, 2
push 2
push eax
call fcn.0048eb20
add esp, 8
mov ebx, esp
mov ecx, ebx
mov edx, 0x10
push 0x10
push edi
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0x410]
lea ecx, [esp + 0x10]
mov edx, 0x10
push 0x10
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0x420]
lea ecx, [esp + 0x20]
mov edx, 0x10
push 0x10
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0x430]
lea ecx, [esp + 0x30]
mov edx, 0x10
push 0x10
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0x440]
lea ecx, [esp + 0x40]
mov edx, 0x10
push 0x10
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0x450]
lea ecx, [esp + 0x50]
mov edx, 0x10
push 0x10
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0x460]
lea ecx, [esp + 0x60]
mov edx, 0x10
push 0x10
push eax
call fcn.0048eb20
add esp, 8
lea eax, [esp + 0x470]
lea ecx, [esp + 0x70]
mov edx, 0x10
push 0x10
push eax
call fcn.0048eb20
add esp, 8
xor eax, eax
nop
nop
nop
nop
mov ecx, dword [esp + eax*8]
mov edx, dword [esp + eax*8 + 4]
xor edx, dword [esp + eax*8 + 0x804]
xor ecx, dword [esp + eax*8 + 0x800]
xor dword [esi + eax*8], ecx
xor dword [esi + eax*8 + 4], edx
add eax, 1
cmp eax, 0x80
jne 0x48eab0
push 0x400
lea eax, [esp + 0x804]
push eax
call fcn.00467170
add esp, 8
push 0x400
push edi
call fcn.00467170
add esp, 8
push 0x400
push ebx
call fcn.00467170
add esp, 8
mov ecx, dword [esp + 0xc00]
xor ecx, ebp
call fcn.0049f6f0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x490690
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
xor esi, esi
call fcn.00406360
test al, al
je 0x4906e2
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
xor esi, esi
push edi
push eax
push ecx
push 0x1f0001
call fcn.0043cbd0
add esp, 0x10
test al, al
je 0x490738
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x28]
mov dword [esp], 0xc
mov dword [esp + 4], esi
mov dword [esp + 8], 0
mov eax, esp
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x490716
mov esi, eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x490738
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043d3e0
add esp, 4
push eax
push ebx
push str.CreateMutex___s___failed:__s
call fcn.00438d90
add esp, 0xc
mov dword [edi], eax
xor esi, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x490747
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x490756
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
Function at 0x490790
Capabilities:
Compare security identifiers

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x20]
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 8], eax
push 9
push str..pipe_
push esi
call fcn.004b2e00
add esp, 0xc
test eax, eax
je 0x4907ce
push 0x16
push str._home_simon_mem_.build_workdirs_bob_u160jzna_putty_windows_named_pipe_client.c
push str.strncmp_pipename___.pipe___9___0
call fcn.004aeeb3
add esp, 0xc
lea eax, [esi + 9]
push 0x5c
push eax
call fcn.004a25b0
add esp, 8
test eax, eax
je 0x4907f4
push 0x17
push str._home_simon_mem_.build_workdirs_bob_u160jzna_putty_windows_named_pipe_client.c
push str.strchr_pipename__9_____NULL
call fcn.004aeeb3
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
mov ebp, esi
push esi
call edi
cmp eax, 0xffffffff
jne 0x49084c
call ebx
cmp eax, 0xe7
jne 0x490894
push 0
mov esi, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
jne 0x490800
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043d3e0
add esp, 4
push eax
push esi
push str.Error_waiting_for_named_pipe__s:__s
jmp 0x4908aa
mov esi, eax
call fcn.0043ca80
test eax, eax
je 0x4908b4
mov edi, eax
mov eax, esp
lea ecx, [esp + 4]
push eax
push 0
push 0
push 0
push ecx
push 1
push 6
push esi
call dword [0x5042cc]
test eax, eax
je 0x4908d2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043d3e0
add esp, 4
push eax
push str.Unable_to_get_named_pipe_security_information:__s
jmp 0x490902
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043d3e0
add esp, 4
push eax
push ebp
push str.Unable_to_open_named_pipe__s:__s
call fcn.00438d90
add esp, 0xc
jmp 0x49090a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043d3e0
add esp, 4
push eax
push str.Unable_to_get_user_SID:__s
jmp 0x490902
push edi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4908ec
push dword [esp]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x490915
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
push str.Owner_of_named_pipe__s_is_not_us
call fcn.00438d90
add esp, 8
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov esi, 0xffffffff
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4909a0
Capabilities:
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0xc], eax
push 0
push 0x34
push 1
call fcn.004397d0
add esp, 0xc
mov esi, eax
mov dword [eax + 0x30], 0x4d92a4
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], 0
mov dword [eax], 0
push ebx
call fcn.0043ef00
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi + 0x24], 0
push 9
push str..pipe_
push ebx
call fcn.004b2e00
add esp, 0xc
test eax, eax
je 0x490a26
push 0xd5
push str._home_simon_mem_.build_workdirs_bob_u160jzna_putty_windows_named_pipe_server.c
push str.strncmp_pipename___.pipe___9___0
call fcn.004aeeb3
add esp, 0xc
lea ebp, [esi + 0x2c]
lea ebx, [esi + 4]
mov eax, dword [esp + 0x24]
add eax, 9
push 0x5c
push eax
call fcn.004a25b0
add esp, 8
test eax, eax
je 0x490a59
push 0xd6
push str._home_simon_mem_.build_workdirs_bob_u160jzna_putty_windows_named_pipe_server.c
push str.strchr_pipename__9_____NULL
call fcn.004aeeb3
add esp, 0xc
mov edi, esi
add edi, 0x30
push ebp
push ebx
push esi
push 0xc0000000
call fcn.0043cbd0
add esp, 0x10
test al, al
je 0x490b2c
mov dword [esp], 0xc
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov eax, esp
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 8
push 0x40080003
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x490b08
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x20], eax
push esi
push 0x490b50
push eax
call fcn.00426280
add esp, 0xc
mov dword [esi + 0x24], eax
mov ecx, esi
xor edx, edx
call fcn.00490b60
jmp 0x490b2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043d3e0
add esp, 4
push eax
push dword [esp + 0x28]
push str.unable_to_create_named_pipe__s:__s
call fcn.00438d90
add esp, 0xc
mov dword [ebp], eax
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0049f6f0
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x490b60
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov esi, ecx
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0xc], eax
lea ebp, [ecx + 0x10]
jmp 0x490bc1
mov dword [esp], 0xc
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov eax, esp
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 8
push 0x40000003
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x490c21
test bl, 1
jne 0x490bf0
push ebp
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x490bf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x490bf2
mov edi, eax
cmp eax, 0x217
je 0x490bf2
jmp 0x490c7b
xor ebx, ebx
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 0x28]
mov dword [esp], edi
mov ecx, dword [eax]
mov edx, dword [esp]
push edx
push 0x490d20
push eax
call dword [ecx + 0x10]
add esp, 0xc
test eax, eax
je 0x490b80
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x490b80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call fcn.0043d3e0
add esp, 4
push eax
push str.Error_while_listening_to_named_pipe:__s
call fcn.00438d90
add esp, 8
mov ebx, eax
push dword [esi + 8]
call fcn.00435d80
add esp, 4
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
push edi
push ebx
push 0
push eax
push 1
push ecx
call dword [edx]
add esp, 0x18
push ebx
call fcn.00439860
add esp, 4
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0049f6f0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp edi, 0x3e5
jne 0x490c29
jmp 0x490c68

Function at 0x493050
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x20]
test edi, edi
je 0x49307a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea esi, [edi - 1]
mov ebx, edi
and ebx, 3
cmp esi, 3
jae 0x493081
xor esi, esi
test ebx, ebx
jne 0x4930ce
jmp 0x4930e3
mov eax, 1
jmp 0x4930ed
mov dword [esp], ebx
and edi, 0xfffffffc
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
xor bl, byte [ecx]
mov bh, byte [eax + 1]
movzx ebp, bl
xor bh, byte [ecx + 1]
or ebp, esi
mov bl, byte [eax + 2]
xor bl, byte [ecx + 2]
movzx esi, bh
movzx ebx, bl
or ebx, esi
or ebx, ebp
movzx edx, byte [eax + 3]
add eax, 4
xor dl, byte [ecx + 3]
add ecx, 4
movzx esi, dl
or esi, ebx
add edi, 0xfffffffc
jne 0x493090
mov ebx, dword [esp]
test ebx, ebx
je 0x4930e3
xor edi, edi
movzx edx, byte [eax + edi]
xor dl, byte [ecx + edi]
movzx edx, dl
or esi, edx
add edi, 1
cmp ebx, edi
jne 0x4930d0
mov eax, 0x100
sub eax, esi
shr eax, 8
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49c3b0
Capabilities:
Hash data using sha512

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x10]
cmp ebx, 0x41
jb 0x49c3d0
push pe_nt_image_headers32
push str._home_simon_mem_.build_workdirs_bob_u160jzna_putty_crypto_blake2.c
push str.hashlen___ssh_blake2b.hlen
call fcn.004aeeb3
add esp, 0xc
push 0
push 0xf0
push 1
call fcn.004397d0
add esp, 0xc
lea edx, [eax + 0xe4]
mov dword [eax + 0xe4], 0x4d9c48
mov dword [eax + 0x40], ebx
lea ecx, [eax + 0xd8]
mov dword [eax + 0xd8], 0x49c6f0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], ecx
mov dword [eax + 0xe8], ecx
mov ecx, 0x10
mov edi, eax
mov esi, 0x4d9c78
rep movsd dword es:[edi], dword [esi]
xor ebx, 0xf2bdc908
mov dword [eax], ebx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
mov dword [eax + 0xcc], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov eax, edx
pop esi
pop edi
pop ebx
ret
Function at 0x49ff77
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49ffb6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49ffb6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49ffb6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x49ffb6
cmp dword [ecx + 0x74], 0xe
jbe 0x49ffb6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4b1b84
Capabilities:
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b6411

Function at 0x4b3cd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b3cfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b3cfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4b40d1
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4db748
push 0x4db740
push str.FlsAlloc
push 0x1e
call fcn.004b4764
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b4105
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x4b410b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b414f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4db758
push 0x4db750
push str.FlsGetValue
push 0x20
call fcn.004b4764
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b4186
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4b6411
Capabilities:
Hash data using murmur3

Disassembly:
je 0x4b63cf
push 1
call fcn.004b61a0
pop ecx
cmp dword [ebp + 8], eax
jne 0x4b63cb
push dword [ebp + 8]
call fcn.004b733a
push eax
call fcn.004c0ffc
pop ecx
pop ecx
add byte [ecx + 0x59], bl
test eax, eax
jne 0x4b63cf
xor al, al
pop ebp
ret
mov al, 1
pop ebp
ret
mov edi, edi
pushal
pushfd
and esi, edi
mov esi, eax
mov esi, eax
add esi, eax
test edx, edx
jb 0x4b63a8
xor edx, esp
mov esi, esi
mov eax, 0x29946a8
xor esi, 0x28da51bb
dec ebx
sub esi, eax
mov eax, 0x29e00cfe
test edi, eax
jb 0x4b63c4
mov ecx, esp
and esi, edi
rol eax, 1
add esi, 0xaa42d3f
mov edx, 0x3fb0d97
or esi, edi
test eax, 0x6d54764
jo 0x4b6463
not eax
mov ecx, 0x27f6cd
push eax
add cl, al
invalid