joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100133b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10013550
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10013474
cmp dword [ebp - 4], 0x50000000
jb 0x100133f1
cmp dword [ebp - 4], 0x80000000
ja 0x100133f1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100133ca
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10013417
jmp 0x10013474
cmp dword [ebp - 0x14], 0x10000
jne 0x1001345a
cmp dword [ebp - 0x18], 0x10000
jb 0x1001345a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1001344d
mov eax, dword [ebp - 8]
jmp 0x10013476
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1001346f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10013550
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100133ca
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10013480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10013580
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1001353c
cmp dword [ebp - 4], 0x50000000
jb 0x100134bc
cmp dword [ebp - 4], 0x80000000
ja 0x100134bc
mov dword [ebp - 4], 0x80010000
jmp 0x10013495
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100134e2
jmp 0x1001353c
cmp dword [ebp - 0x14], 0x10000
jne 0x10013525
cmp dword [ebp - 0x18], 0x10000
jb 0x10013525
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10013518
mov eax, dword [ebp - 8]
jmp 0x1001353e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10013537
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10013580
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10013495
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10013cb0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10013cc5
xor eax, eax
jmp 0x10013d3a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x10013cf2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10013d35
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10013d33
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10013d2f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10013d33
xor eax, eax
jmp 0x10013d3a
jmp 0x10013ce9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10013f00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10134e30]
mov dword [ebp - 4], eax
jmp 0x10013f19
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10013f36
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10013f10
mov esp, ebp
pop ebp
ret
Function at 0x10014380
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10134e40], eax
je 0x1001439e
mov eax, 0x10dd
jmp 0x1001447f
mov eax, dword [0x10134e50]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001441c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100143fa
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100143fa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10013a20
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x100143a6
mov dword [0x10134e50], 0
call fcn.10013d40
mov ecx, dword [0x10134e4c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10014469
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10014434
mov dword [0x10134e4c], 0
mov dword [0x10134e40], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10014970
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10134e44], 0
je 0x10014989
mov eax, dword [0x10134e44]
jmp 0x10014a29
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1001499b
xor eax, eax
jmp 0x10014a29
push 8
call fcn.100154a4
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100149f1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100149da
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10134e44], eax
mov dword [0x10134e48], 0
mov eax, dword [ebp - 8]
jmp 0x10014a29
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10014a0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100149bb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10134e4c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10134e4c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10015384
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e018]
jne 0x1001538e
repz ret
jmp fcn.100158c7
Function at 0x404f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
push 0x165
push 1
push str.You_are_loading_an_SSH_2_private_key_which_has_an_nold_version_of_the_file_format._This_means_your_key_nfile_is_not_fully_tamperproof._Future_versions_of_nPuTTY_may_stop_supporting_this_private_key_format__nso_we_recommend_you_convert_your_key_to_the_new_nformat._n_nOnce_the_key_is_loaded_into_PuTTYgen__you_can_perform_nthis_conversion_simply_by_saving_it_again._n
call sub.msvcrt.dll_fwrite
add esp, 0x10
leave
ret
Function at 0x405530
Capabilities:
Get common file path

Disassembly:
push ebp
mov eax, dword [0x422020]
mov ebp, esp
test eax, eax
push esi
push ebx
je 0x405570
mov edx, dword [ebp + 8]
mov eax, dword [0x422020]
push 0
push edx
push 0x41d260
push eax
call fcn.00409970
mov esi, eax
mov dword [esp], eax
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
push esi
call fcn.004093f0
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
xor ebx, ebx
lea edx, [ebx + ebx*2]
mov esi, dword [0x422020]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
lea ebx, [eax + 0x200]
push eax
push 1
push ebx
push esi
call fcn.00409450
pop edx
pop ecx
push ebx
mov dword [0x422020], eax
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
pop ecx
cmp ebx, eax
pop esi
jle 0x405572
jmp 0x40553e

Function at 0x405800
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
lea ebx, [ebp - 0x10]
call sub.USER32.dll_GetForegroundWindow
push edi
push edi
push 4
push ebx
mov dword [ebp - 0x10], eax
call fcn.00415d20
add esp, 0x10
lea edi, [ebp - 0x4c]
call sub.USER32.dll_GetCapture
push esi
push esi
push 4
push ebx
mov dword [ebp - 0x10], eax
call fcn.00415d20
add esp, 0x10
lea esi, [ebp - 0x54]
call sub.USER32.dll_GetClipboardOwner
push ecx
push ecx
push 4
push ebx
mov dword [ebp - 0x10], eax
call fcn.00415d20
mov dword [esp], 0xbf
call sub.USER32.dll_GetQueueStatus
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
lea ebx, [ebp - 0x1c]
mov dword [esp], 4
push eax
call fcn.00415d20
mov dword [esp], ebx
call sub.USER32.dll_GetCursorPos
mov dword [esp], 8
push ebx
lea ebx, [ebp - 0x3c]
call fcn.00415d20
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalMemoryStatus
mov dword [esp], 0x20
push ebx
call fcn.00415d20
add esp, 0x10
call sub.KERNEL32.dll_GetCurrentThread
sub esp, 0xc
lea ebx, [ebp - 0x5c]
lea edx, [ebp - 0x44]
push edx
push edi
push esi
push ebx
push eax
call sub.KERNEL32.dll_GetThreadTimes
mov dword [esp], 0x20
push ebx
call fcn.00415d20
add esp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub esp, 0xc
lea edx, [ebp - 0x44]
push edx
push edi
push esi
push ebx
push eax
call sub.KERNEL32.dll_GetProcessTimes
mov dword [esp], 0x20
push ebx
call fcn.00415d20
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405990
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x264
lea ebx, [ebp - 0x117]
mov edi, dword [ebp + 8]
push 0x107
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
push eax
push ebx
call sub.msvcrt.dll_strlen
pop ecx
pop esi
lea esi, [ebp - 0x258]
lea eax, [ebx + eax]
mov word [eax], 0x2a5c
mov byte [eax + 2], 0
push esi
push ebx
call sub.KERNEL32.dll_FindFirstFileA
mov ebx, eax
pop eax
cmp ebx, 0xffffffff
pop edx
je 0x405a05
nop
lea esi, [esi]
push ecx
push ecx
push 0x140
push esi
call edi
pop eax
pop edx
push esi
push ebx
call sub.KERNEL32.dll_FindNextFileA
pop edx
test eax, eax
pop ecx
jne 0x4059e0
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_FindClose
add esp, 0xc
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [ebp - 0x10], eax
push eax
push eax
lea eax, [ebp - 0x10]
push 4
push eax
call edi
mov dword [esp], edi
call fcn.00406700
add esp, 0x10
call fcn.00405950
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x405b00
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x11c
mov ebx, eax
lea esi, [ebp - 0x115]
lea edi, [ebp - 0x10]
jmp 0x405b2b
push eax
push eax
push esi
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
pop ecx
pop eax
push 0x105
push esi
push 0
push ebx
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
jne 0x405b64
push ecx
push edi
push esi
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyA
pop edx
test eax, eax
jne 0x405b20
mov eax, dword [ebp - 0x10]
call fcn.00405b00
sub esp, 0xc
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
jmp 0x405b20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x405c50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, eax
mov edi, ecx
mov eax, edx
test edx, edx
je 0x405cc1
cmp edx, 2
sete dl
and edx, 0xff
dec edx
and edx, 0x40000000
add edx, 0x40000000
cmp eax, 2
setne al
xor ecx, ecx
xor ebx, ebx
mov cl, al
mov bl, al
and eax, 0xff
sub esp, 4
dec ecx
add ebx, 2
and ecx, 0x80
lea eax, [eax + eax*2]
push 0
push ecx
push ebx
push 0
push eax
push edx
push esi
call sub.KERNEL32.dll_CreateFileA
mov dword [edi], eax
inc eax
setne al
pop edx
and eax, 0xff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push esi
call sub.msvcrt.dll_remove
mov dword [edi], 0xffffffff
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4066c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 2
mov ebp, esp
push ebx
sub esp, 0x14
call fcn.00405ce0
mov ebx, eax
cmp eax, 0xffffffff
je 0x4066f8
sub esp, 0xc
lea eax, [ebp - 8]
push 0
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push ebx
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x406700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov eax, 1
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x41c
call fcn.00405ce0
mov ebx, eax
cmp eax, 0xffffffff
je 0x40675e
lea edi, [ebp - 0x10]
lea esi, [ebp - 0x410]
jmp 0x406739
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x406752
push edx
push edx
push eax
push esi
call dword [ebp + 8]
add esp, 0x10
sub esp, 0xc
push 0
push edi
push 0x400
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
jne 0x406728
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4067d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push 1
push ebx
call sub.msvcrt.dll_strlen
mov dword [esp], esi
mov edi, eax
call sub.msvcrt.dll_strlen
lea eax, [edi + eax]
lea eax, [eax + eax*2 + 0xf]
mov dword [esp], eax
call fcn.004094f0
mov edx, esi
mov ecx, dword [ebp + 0xc]
mov edi, eax
mov dword [esp], ebx
call fcn.00406770
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyA
pop esi
test eax, eax
jne 0x406859
sub esp, 0xc
mov ebx, dword [ebp + 0x14]
push ebx
call sub.msvcrt.dll_strlen
pop edx
inc eax
pop ecx
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x10]
push 1
push 0
push edi
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
mov ebx, dword [ebp - 0x10]
push esi
push ebx
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
sub esp, 0xc
push edi
call fcn.004093f0
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406dc0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ecx, 1
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
lea ebx, [ebp - 0x1c]
mov esi, dword [ebp + 8]
mov dl, byte [ecx + esi - 1]
lea eax, [edx - 0x41]
cmp al, 0x19
ja 0x406e63
movsx eax, dl
sub eax, 0x41
mov dword [ebx + ecx*4 - 4], eax
inc ecx
cmp ecx, 5
jne 0x406dd4
mov ebx, dword [ebp - 0x1c]
cmp ebx, 0xffffffff
je 0x406eb0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xffffffff
je 0x406eb0
mov esi, dword [ebp - 0x14]
cmp esi, 0xffffffff
je 0x406ebc
mov edx, dword [ebp - 0x10]
cmp edx, 0xffffffff
setne al
shl ecx, 0xc
and edx, 0x3f
shl ebx, 0x12
and esi, 0x3f
or ecx, ebx
and eax, 0xff
or ecx, edx
mov edi, eax
shl esi, 6
mov edx, dword [ebp + 0xc]
or ecx, esi
add edi, 2
mov eax, ecx
shr eax, 0x10
mov byte [edx], al
mov eax, ecx
shr eax, 8
cmp edi, 2
mov byte [edx + 1], al
jle 0x406e59
mov byte [edx + 2], cl
add esp, 0x10
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edx - 0x61]
cmp al, 0x19
ja 0x406e75
movsx eax, dl
sub eax, 0x47
jmp 0x406de9
lea eax, [edx - 0x30]
cmp al, 9
jbe 0x406ea2
mov eax, 0x3e
cmp dl, 0x2b
je 0x406de9
mov al, 0x3f
cmp dl, 0x2f
je 0x406de9
cmp dl, 0x3d
jne 0x406eb0
or eax, 0xffffffff
jmp 0x406de9
movsx eax, dl
add eax, 4
jmp 0x406de9
xor edi, edi
add esp, 0x10
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebp - 0x10], 0xffffffff
jne 0x406eb0
shl ecx, 0xc
mov eax, dword [ebp + 0xc]
shl ebx, 0x12
mov edi, 1
or ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
jmp 0x406e59
Function at 0x406f50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ecx, 5
mov ebp, esp
push edi
cld
push esi
lea eax, [ebp - 0x2d]
push ebx
mov edi, eax
sub esp, 0x84
mov esi, str.PuTTY_User_Key_File_
mov dword [ebp - 0x84], eax
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x41d73d]
mov esi, str._____BEGIN_SSH2_ENCRYPTED_PRIVAT
mov byte [edi], al
lea eax, [ebp - 0x6e]
mov edi, eax
mov cl, 8
mov dword [ebp - 0x88], eax
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x41d760]
mov byte [edi], al
mov eax, dword [str._____BEGIN]
mov dword [ebp - 0x18], eax
mov eax, dword [0x41d765]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41d769]
mov dword [ebp - 0x10], eax
push 0x41d704
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_fopen
add esp, 0x10
mov esi, eax
test eax, eax
je 0x407072
lea ebx, [ebp - 0x4d]
push eax
push 0x20
push 1
push ebx
call sub.msvcrt.dll_fread
mov dword [esp], esi
mov edi, eax
call sub.msvcrt.dll_fclose
add esp, 0x10
test edi, edi
js 0x407072
cmp edi, 0x1f
jle 0x40706b
cld
mov ecx, 0x20
mov edi, str.SSH_PRIVATE_KEY_FILE_FORMAT_1.1_n
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
mov ecx, 2
cmp dl, al
je 0x407042
mov cl, 0x14
mov esi, ebx
mov edi, dword [ebp - 0x84]
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
mov ecx, 3
cmp dl, al
je 0x407042
mov cl, 0xb
lea edi, [ebp - 0x18]
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
mov ecx, 4
cmp dl, al
jne 0x407050
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov cl, 0x20
mov esi, ebx
mov edi, dword [ebp - 0x88]
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
mov ecx, 5
cmp dl, al
je 0x407042
mov ecx, 1
jmp 0x407042
xor ecx, ecx
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push ebx
sub esp, 0xd4
mov eax, 0x7fffffff
div dword [ebp + 0x10]
xor ebx, ebx
mov ecx, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jb 0x409494
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
imul eax, edx
test ecx, ecx
je 0x4094e0
push ebx
push ebx
push eax
push ecx
call sub.msvcrt.dll_realloc
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x409494
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0x2074754f
mov dword [ebp - 0xc8], 0x6d20666f
mov dword [ebp - 0xc4], 0x726f6d65
mov word [ebp - 0xc0], 0x2179
mov byte [ebp - 0xbe], 0
push eax
call fcn.00401d00
mov eax, ebx
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov ebx, eax
jmp 0x409489

Function at 0x4094f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push ebx
sub esp, 0xd4
mov eax, 0x7fffffff
div dword [ebp + 0xc]
xor ebx, ebx
cmp eax, dword [ebp + 8]
jb 0x409533
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
imul eax, ecx
test eax, eax
jne 0x40951a
mov al, 1
sub esp, 0xc
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x409533
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0x2074754f
mov dword [ebp - 0xc8], 0x6d20666f
mov dword [ebp - 0xc4], 0x726f6d65
mov word [ebp - 0xc0], 0x2179
mov byte [ebp - 0xbe], 0
push eax
call fcn.00401d00
mov eax, ebx
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x409d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [ebp - 0x48], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], ecx
test edx, edx
jle 0x409ded
mov eax, dword [eax + 0xc]
cmp eax, 0x20
jg 0x409dfc
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp edi, eax
jg 0x409df5
mov dword [ebp - 0x40], 0
nop
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
shr eax, 0x18
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x40]
shr eax, 0x10
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x40]
shr eax, 8
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0x40]
mov byte [ebp - 0xd], al
call dword [edx]
mov ecx, dword [ebp - 0x48]
mov ebx, eax
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x44]
push ecx
push ebx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x10]
push 4
push edx
push ebx
call dword [eax + 4]
pop eax
mov eax, dword [ebp - 0x44]
pop edx
lea edx, [ebp - 0x30]
push edx
push ebx
call dword [eax + 8]
mov eax, dword [ebp - 0x40]
inc eax
add esp, 0x10
mov dword [ebp - 0x40], eax
test edi, edi
jle 0x409dc1
xor edx, edx
mov al, byte [edx + ebp - 0x30]
xor byte [edx + esi], al
inc edx
cmp edx, edi
jne 0x409db5
mov eax, dword [ebp + 0xc]
sub eax, edi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x409ded
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 0xc]
cmp eax, 0x20
jg 0x409dfc
mov edx, dword [ebp + 0xc]
cmp edx, eax
jle 0x409de4
mov edx, eax
add esi, edi
mov edi, edx
jmp 0x409d50
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, eax
jmp 0x409d47
push eax
push 0x3c2
push str._home_nightlybuild_buildroot_packages_FileZilla3_src_putty_sshrsa.c
push str.h__hlen___SSH2_KEX_MAX_HASH_LEN
call sub.msvcrt.dll__assert
jmp fcn.00409e20
Function at 0x40fdf0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov edx, 0x10
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 8], 0x10
pop ebp
jmp fcn.0040fa20

Function at 0x4100a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
pop ebp
jmp fcn.0040ff50