joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf79253b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
sub esp, 0x108
test eax, eax
je 0xf7925c4
cmp word [eax], 0
je 0xf7925c4
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0f7927f1
test eax, eax
jne 0xf792580
push 0xf7bb1cc
lea eax, [ebp - 0x108]
push eax
call fcn.0f7878d2
add esp, 8
test eax, eax
je 0xf792586
mov eax, 0x34
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xffffffff
mov dword [ecx], eax
jne 0xf7925c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0xf7925c4
cmp eax, 3
je 0xf7925b9
cmp eax, 0x35
je 0xf7925c4
mov eax, 5
jmp 0xf792580
mov eax, 0x4c
jmp 0xf792580
xor eax, eax
jmp 0xf792580
mov eax, 0x35
jmp 0xf792580

Function at 0xf7925cb
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push 2
lea ecx, [ebp - 0x210]
push dword [ebp + 8]
push ecx
call fcn.0f79265e
push 2
lea edx, [ebp - 0x108]
push dword [ebp + 0xc]
push edx
call fcn.0f79265e
lea ecx, [ebp - 0x210]
lea edx, [ebp - 0x108]
push ecx
push edx
call dword [sym.imp.MSVCRT20.dll_rename]
add esp, 8
test eax, eax
je 0xf792658
call dword [sym.imp.MSVCRT20.dll__errno]
mov eax, dword [eax]
cmp eax, 2
je 0xf79263c
cmp eax, 0xd
je 0xf792643
cmp eax, 0x11
je 0xf79264a
cmp eax, 0x12
je 0xf792651
mov eax, 5
test eax, eax
je 0xf792658
push eax
call fcn.0f72689c
mov eax, 0x35
jmp 0xf792632
mov eax, 0x4b
jmp 0xf792632
mov eax, 0x3a
jmp 0xf792632
mov eax, 0x4a
jmp 0xf792632
mov esp, ebp
pop ebp
ret 8
Function at 0xf792c0d
Capabilities:
Read file on windows

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT20.dll__read]
add esp, 0xc
ret 0xc
Function at 0xf795095
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
lea eax, [esp]
push ebx
push esi
push edi
push ebp
xor edi, edi
mov word [esp + 0x10], di
push eax
push dword [esp + 0x28]
call fcn.0f73651e
movzx ecx, word [eax]
cmp ecx, 1
je 0xf795174
cmp ecx, 8
je 0xf79517b
push eax
xor esi, esi
call fcn.0f7348f7
movsx ebx, ax
test ebx, ebx
jle 0xf79516d
cmp ebx, 0xff
jg 0xf79516d
cmp dword [0xf7ae760], edi
jne 0xf7950fb
push str.windir
call dword [sym.imp.MSVCRT20.dll__wgetenv]
add esp, 4
xor ebp, ebp
inc esi
je 0xf795145
cmp dword [0xf7ae760], ebp
je 0xf79511e
call dword [sym.imp.MSVCRT20.dll___p__environ]
mov eax, dword [eax]
cmp dword [eax + esi*4 - 4], ebp
je 0xf795145
cmp dword [0xf7ae760], ebp
jne 0xf79512c
call dword [sym.imp.MSVCRT20.dll___p__wenviron]
mov eax, dword [eax]
cmp dword [eax + esi*4 - 4], ebp
je 0xf795145
cmp esi, ebx
jne 0xf7950fd
cmp dword [0xf7ae760], 0
je 0xf79515f
call dword [sym.imp.MSVCRT20.dll___p__environ]
mov eax, dword [eax]
mov edi, dword [eax + esi*4 - 4]
test edi, edi
jne 0xf79523f
push 0xf7bb244
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebp, eax
jmp 0xf795287
call dword [sym.imp.MSVCRT20.dll___p__wenviron]
mov eax, dword [eax]
mov edi, dword [eax + esi*4 - 4]
jmp 0xf795145
push 5
call fcn.0f72689c
push 0x5e
call fcn.0f72689c
push dword [eax + 8]
call sym.VB40032.DLL_rtcTrimBstr
cmp word [eax], 0
mov esi, eax
jne 0xf795199
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 5
call fcn.0f72689c
cmp dword [0xf7ae760], 0
je 0xf795231
mov eax, 0
test esi, esi
je 0xf7951b4
mov eax, dword [esi - 4]
shr eax, 1
push 0
push 0
push 0
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push eax
push esi
push 0
push 0
call ebp
mov edi, eax
test edi, edi
je 0xf7951ed
lea eax, [edi + 1]
push eax
call fcn.0f726e61
mov ebx, eax
test ebx, ebx
jne 0xf7951f3
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0xe
call fcn.0f72689c
mov ebx, dword [esp + 0x10]
jmp 0xf7951df
mov eax, 0
test esi, esi
je 0xf795201
mov eax, dword [esi - 4]
shr eax, 1
push 0
push 0
push edi
push ebx
push eax
push esi
push 0
push 0
call ebp
push ebx
mov byte [ebx + edi], 0
call dword [sym.imp.MSVCRT20.dll_getenv]
add esp, 4
mov edi, eax
push ebx
call fcn.0f726e12
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0xf795145
push esi
call dword [sym.imp.MSVCRT20.dll__wgetenv]
add esp, 4
mov edi, eax
jmp 0xf795225
cmp dword [0xf7ae760], 0
je 0xf79529c
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
mov esi, eax
test esi, esi
jne 0xf795268
push 0xe
call fcn.0f72689c
lea eax, [esi - 1]
mov ebp, dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push eax
push 0
call ebp
mov ebp, eax
test ebp, ebp
je 0xf795287
push esi
push ebp
push 0xffffffffffffffff
push edi
push 0
push 0
call ebx
push 0xf7ae740
call fcn.0f7a212f
test ebp, ebp
jne 0xf7952a2
push 0xe
call fcn.0f72689c
push edi
jmp 0xf795152
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0xf79c9e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
mov eax, dword [ecx + 0x90]
mov esi, ecx
mov edi, dword [ebp + 8]
test eax, eax
je 0xf79ca10
push eax
mov esi, dword [eax]
mov dword [edi], eax
call dword [esi + 4]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
push 0x409
push 1
push 2
push 0xf7b1990
call dword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
test eax, eax
jl 0xf79ca6a
mov eax, dword [edi]
lea ecx, [ebp - 8]
push ecx
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
test eax, eax
jl 0xf79ca62
mov eax, dword [ebp - 8]
push dword [ebp - 8]
cmp dword [eax + 0x14], 1
mov eax, dword [edi]
push eax
mov eax, dword [eax]
jne 0xf79ca5f
call dword [eax + 0x30]
mov eax, dword [edi]
push eax
mov dword [esi + 0x90], eax
mov esi, dword [eax]
call dword [esi + 4]
xor eax, eax
jmp 0xf79ca08
call dword [eax + 0x30]
mov eax, dword [edi]
push eax
mov eax, dword [eax]
call dword [eax + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0xf79caf0
push 0
lea eax, [ebp - 0x108]
push 0
lea ecx, [ebp - 4]
push eax
lea edx, [ebp - 0x20c]
push ecx
push edx
call dword [sym.imp.MSVCRT20.dll__splitpath]
add esp, 0x14
lea ecx, [ebp - 4]
lea edx, [ebp - 0x20c]
push ecx
push edx
call fcn.0f787b4a
add esp, 8
lea ecx, [ebp - 0x108]
lea edx, [ebp - 0x20c]
push ecx
push edx
call fcn.0f787b76
add esp, 8
lea ecx, [ebp - 0x20c]
push edi
push ecx
call fcn.0f79cb81
test eax, eax
jne 0xf79caf0
mov eax, dword [edi]
push eax
mov dword [esi + 0x90], eax
mov esi, dword [eax]
call dword [esi + 4]
xor eax, eax
jmp 0xf79ca08
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0f79cb81
test eax, eax
jne 0xf79cb28
mov eax, dword [edi]
push eax
mov dword [esi + 0x90], eax
mov esi, dword [eax]
call dword [esi + 4]
xor eax, eax
jmp 0xf79ca08
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0f79cb81
test eax, eax
jne 0xf79cb60
mov eax, dword [edi]
push eax
mov dword [esi + 0x90], eax
mov esi, dword [eax]
call dword [esi + 4]
xor eax, eax
jmp 0xf79ca08
push 0
push 0xf7bb880
push 0x9c66
call fcn.0f78435d
mov eax, 0x800a9c66
mov dword [edi], 0
jmp 0xf79ca08
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x30cd5a97
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x79c35baa
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40b4dc
Capabilities:
Act as tcp client
Check internet connectivity via wininet
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403fcc
jmp 0x40b4fd
push 0x3e8
call sub.kernel32.dll_Sleep
push 0
push 0
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x40b4f3
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40b55e
mov eax, dword [ebx + 0x10]
mov edx, 0x40b634
call fcn.004043a4
jne 0x40b52d
lea eax, [ebx + 0x10]
call fcn.00403fcc
jmp 0x40b566
mov eax, dword [ebx + 0x10]
mov edx, 0x40b640
call fcn.004043a4
jne 0x40b549
lea eax, [ebx + 0x10]
mov edx, 0x40b634
call fcn.00404020
cmp dword [ebx + 0x10], 0
jne 0x40b566
lea eax, [ebx + 0x10]
mov edx, 0x40b640
call fcn.00404020
jmp 0x40b566
lea eax, [ebx + 0x10]
call fcn.00403fcc
mov eax, ebx
call fcn.0040b32c
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404458
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40b5b6
or edi, 0xffffffff
jmp 0x40b5f0
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404458
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40b5f0
or edi, 0xffffffff
test edi, edi
je 0x40b613
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40b64c
call fcn.004042ac
mov eax, ebx
call fcn.0040b204
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40b4fd

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x4033fc], eax
mov eax, dword [ebp + 4]
mov dword [0x40323a], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401020
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40323a]
mov dword [ebp - 0x48], eax
mov eax, 0x4016df
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x40323a]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.lukifas
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403448], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403448]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010bc
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010b5
mov esp, ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4bc8411c
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x356bc7
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4af728
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af7ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4af81c
push ebx
push 0x4af82c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4af7aa
mov ax, 0x83
call fcn.004af34c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004af6fc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4af7b3
call fcn.004af6fc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af806
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4af91c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
jmp 0x4af9db
cmp dword [esi + 0x10], 0x1000
jne 0x4af9c7
test byte [esi + 0x15], 1
jne 0x4af9c7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4af978
cmp ebp, 2
je 0x4af978
cmp ebp, 0x10
je 0x4af978
cmp ebp, 0x20
jne 0x4af994
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4af994
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4af9a5
mov eax, dword [esi]
add eax, ebx
call fcn.004af914
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4af998
cmp byte [esp + 4], 0
je 0x4af9c7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4af94d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43b63d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
or ecx, esi
mov ecx, ecx
push esi
pop ecx
call fcn.0043b66f
push ecx
pop ecx
sub esi, 1
xor dword [edx], eax
sub esi, ecx
add edx, 1
sub ecx, ecx
cmp edx, edi
jne fcn.0043b63d
push esi
pop ecx
dec esi
mov ecx, esi
ret
Function at 0x40ce0a
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push esi
lea edx, [6]
push edx
mov edi, 0x4ee
shr edi, 8
push edi
pop dword [0x42499a]
push 0x424b96
mov ebx, 0x482
and ebx, 0xff
or ebx, ebx
jne 0x40ce3f
shl ebx, 6
mov dword [ebp - 0x30], ebx
push 0x60
jmp loc.00462570
Function at 0x401819
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.00475920
mov ebp, dword [esp + 0x102c]
mov esi, dword [esp + 0x1020]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp byte [esi], 0x2d
jne 0x401a97
mov ebx, dword [esp + 0x1024]
push str._load
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x401b1e
lea ebp, [esi + 1]
mov ebx, dword [0x497060]
test ebx, ebx
je 0x401898
mov edi, 0x497064
push dword [ebx + 0x44]
push ebp
call fcn.004854a0
add esp, 8
test eax, eax
je 0x401b4f
mov ebx, dword [edi]
add edi, 4
test ebx, ebx
jne 0x40187b
push 0x4a7a52
push esi
call fcn.004854a0
add esp, 8
xor edi, edi
test eax, eax
mov ebx, dword [esp + 0x1024]
je 0x401b84
push 0x4ac720
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x401c55
push 0x4a7dd1
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x401ca2
push str._hostkey
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x401d9b
push 0x4b0cde
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x401cef
push 0x4b089f
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x401cef
push 0x4b1612
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x401cef
push 0x4afd47
push esi
call fcn.004854a0
add esp, 8
test eax, eax
mov ebx, dword [esp + 0x102c]
je 0x402030
push 0x4ac1ca
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x4020cb
push 0x4b095a
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x402158
push 0x4a7845
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x4021b0
push str._agent
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x4019d0
push str._pagent
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x4019d0
push str._pageant
push esi
call fcn.004854a0
add esp, 8
test eax, eax
jne 0x401a07
xor edi, edi
inc edi
mov eax, dword [esp + 0x1028]
test eax, eax
js 0x402eae
test byte [0x4a1594], 2
jne 0x402ea0
test eax, eax
jne 0x401b76
push 1
push 0x1d
push ebx
call fcn.0040379e
add esp, 0xc
xor edi, edi
inc edi
push str._noagent
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x402270
push str._nopagent
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x402270
push str._nopageant
push esi
call fcn.004854a0
add esp, 8
test eax, eax
je 0x402270
push str._no_trivial_auth
push esi
call fcn.004854a0
add esp, 8
test eax, eax
jne 0x4022c6
xor edi, edi
inc edi
cmp dword [esp + 0x1028], 0
js 0x402eae
test byte [0x4a1594], 2
jne 0x402ea0
cmp dword [esp + 0x1028], 0
mov ebx, dword [esp + 0x102c]
jne 0x401b76
jmp 0x4022b6
xor edi, edi
cmp dword [esp + 0x1028], 0
js 0x402eae
mov ebx, dword [0x4a1594]
invalid
Function at 0x404297
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84c
mov bl, byte [esp + 0x864]
mov ecx, dword [esp + 0x860]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x848], eax
push 0x40a32e
push 0x30
push ecx
mov edi, ecx
call fcn.0040cb08
add esp, 0xc
mov ebp, eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax + 0x20], xmm0
mov esi, 0x4b6a76
push esi
call fcn.0045add3
add esp, 4
mov dword [ebp + 0x2c], eax
mov byte [ebp + 0x28], bl
push esi
push esi
push esi
push edi
call fcn.0040ca13
add esp, 0x10
mov edi, eax
sub esp, 0x1c
mov eax, 0x14
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
movaps xmm0, xmmword [0x4978a0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call fcn.0040cb94
add esp, 0x1c
push ebp
call fcn.0040c710
add esp, 4
mov dword [esp + 0x83c], eax
xor eax, eax
push eax
call fcn.0040c710
add esp, 4
mov dword [esp + 0x838], eax
mov eax, str.Apply
mov ecx, str.Open
test bl, bl
cmovne ecx, eax
mov eax, dword [esp + 0x83c]
mov edx, dword [esp + 0x838]
mov esi, 0x61
mov ebx, 0x6f
cmovne ebx, esi
mov esi, 0
push eax
mov eax, 0x40a352
push eax
push edx
push ebx
push ecx
push edi
call fcn.0040ceda
add esp, 0x18
mov dword [ebp + 0x14], eax
mov bl, 1
mov byte [eax + 0x21], bl
mov eax, dword [ebp + 0x14]
mov dword [eax + 0xc], 3
push ebp
call fcn.0040c710
add esp, 4
mov dword [esp + 0x834], eax
push esi
call fcn.0040c710
add esp, 4
mov dword [esp + 0x830], eax
mov eax, dword [esp + 0x834]
mov ecx, dword [esp + 0x830]
push eax
mov eax, 0x40a352
push eax
push ecx
push 0x63
push 0x4ac63b
push edi
call fcn.0040ceda
add esp, 0x18
mov dword [ebp + 0x18], eax
mov byte [eax + 0x22], bl
mov ebx, dword [esp + 0x860]
mov eax, dword [ebp + 0x18]
mov dword [eax + 0xc], 4
mov eax, dword [0x497058]
push eax
push str.Basic_options_for_your__s_session
call fcn.0045ad89
add esp, 8
mov edi, eax
push eax
push 0x4abc88
push ebx
call fcn.0040c97a
add esp, 0xc
push edi
call fcn.00411739
add esp, 4
mov eax, str.Save_the_current_session_settings
cmp byte [esp + 0x864], 0
jne 0x4047ff
mov dword [esp + 4], ebp
push 0x14
push ebx
call fcn.0040cb79
add esp, 8
mov ecx, ebx
invalid

Function at 0x40fe17
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40fe31
push esi
call fcn.0040f98f
add esp, 4
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, 2
je 0x40fe4f
cmp eax, 1
jne 0x40fea8
add esi, 8
push ebx
push edi
push esi
call fcn.0045b420
add esp, 0xc
jmp 0x40fea8
mov eax, dword [esi]
test eax, eax
jne 0x40fe6b
push 0x2f
push str..._logging.c
push str.ctx__lgfp
call fcn.0048233d
add esp, 0xc
mov eax, dword [esi]
push eax
push ebx
push 1
push edi
call fcn.00484705
add esp, 0x10
cmp eax, ebx
jae 0x40fea8
mov eax, dword [esi]
test eax, eax
je 0x40fe91
push eax
call fcn.00483dfb
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 3
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
push str.Disabled_writing_session_log_due_to_error_while_writing
push eax
call dword [ecx]
add esp, 8
pop esi
pop edi
pop ebx
ret