joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e8b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43e8e3
push esi
call fcn.004419a0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43e8dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43e969
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43e952
mov eax, dword [esi + 8]
test eax, eax
je 0x43e907
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43e94e
cmp eax, 2
je 0x43e952
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43e8fa
cmp eax, 3
je 0x43e92d
cmp eax, 1
jne 0x43e8fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43e8fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43e8fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043e990
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43e978
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043e990
add esp, 4
pop esi
ret

Function at 0x44c110
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x44c176
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x44c176
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x44c157
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x44c500
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x44c538
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x44d270
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x44d2b9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x44d730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47bba0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0044d2e0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0044d360
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0044d360
lea ecx, [esi + 0xc]
call fcn.00469319
lea ecx, [esi + 0x10]
call fcn.00469319
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0044e8f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0044e8f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0044e8f0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046938e
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046938e
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x46a1d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00474609
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46a205
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0046a218
pop edi
pop esi
pop ebx
ret 8

Function at 0x46b7ef
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46b827
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00469835
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046980d
jmp 0x46b833
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46d0df
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46d121
call fcn.00474609
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46d121
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46d118
xor eax, eax
jmp 0x46d129
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046d12f
pop edi
pop esi
pop ebx
ret 4

Function at 0x474b39
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x474b67
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x474b85
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00474a9f
jmp 0x474b85
mov eax, dword [esi + 0x14]
test eax, eax
je 0x474b85
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00474a9f
test edi, edi
mov eax, edi
jne 0x474b6f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov eax, dword [eax + 4]
mov edi, dword [ebp + 8]
test eax, eax
je 0x403034
cmp eax, 1
je 0x403050
cmp eax, 2
je 0x403070
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], ebx
call fcn.00402c90
mov eax, dword [ebx + 4]
cmp eax, 1
jne 0x403022
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], edi
lea eax, [ebx + 8]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00403b10
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
test eax, eax
je 0x40309c
mov dword [esp + 8], edi
mov ecx, 1
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], str.ctx__lgfp
mov esi, 0x2d
mov ebx, str..._logging.c
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll__assert
lea esi, [esi]

Function at 0x40b950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x40b95f
leave
ret
mov dword [esp], str.len__0
mov edx, 0x9a9
mov eax, str..._psftp.c
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll__assert
lea esi, [esi]
push ebp
mov eax, 0x9b3
mov ebp, esp
sub esp, 0x18
mov dword [esp + 8], eax
mov eax, str..._psftp.c
mov dword [esp + 4], eax
mov dword [esp], str.__We_shouldnt_be_here_
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x40b9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test ebx, ebx
mov dword [ebp - 4], edi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
je 0x40b9e2
test esi, esi
jne 0x40ba50
mov ebx, dword [ebp - 0xc]
xor eax, eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, dword [0x459700]
test edi, edi
je 0x40b9d3
mov ecx, dword [0x459710]
test ecx, ecx
setne al
xor edx, edx
test esi, esi
setne dl
test eax, edx
jne 0x40ba83
test esi, esi
je 0x40b9d3
mov eax, dword [0x457090]
lea edx, [eax + esi]
cmp edx, dword [0x457070]
ja 0x40bab4
mov edx, dword [0x457080]
mov dword [esp + 8], esi
add eax, edx
mov edx, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
add dword [0x457090], esi
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ecx, 1
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
add eax, 0x40
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
xor eax, eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cmp ecx, esi
mov ebx, ecx
jbe 0x40ba8b
mov ebx, esi
mov dword [esp + 8], ebx
sub esi, ebx
mov eax, dword [ebp - 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
add dword [0x459700], ebx
sub dword [0x459710], ebx
add dword [ebp - 0x10], ebx
jmp 0x40ba06
lea eax, [edx + 0x1000]
mov edx, 1
mov dword [0x457070], eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [0x457080]
mov dword [esp], eax
call fcn.00403d50
mov dword [0x457080], eax
mov edx, eax
mov eax, dword [0x457090]
jmp 0x40ba24
Function at 0x40c350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], str.psftp:
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 7
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
lea eax, [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov dword [esp], str._n_______try_typing__psftp__h__for_help_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0x27
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
call sub.msvcrt.dll_exit
lea esi, [esi]
lea edi, [edi]
Function at 0x426f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 4
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 8]
movzx eax, byte [eax]
add esi, 2
mov byte [ebp - 0xd], al
movzx edx, byte [edx + 1]
mov byte [ebp - 0xe], dl
jmp 0x426fc3
inc byte [ebp - 0xd]
movzx ecx, byte [ebp - 0xd]
movzx edx, byte [esi + ecx]
add byte [ebp - 0xe], dl
movzx ebx, byte [ebp - 0xe]
movzx eax, byte [esi + ebx]
mov byte [esi + ecx], al
mov byte [esi + ebx], dl
add dl, byte [esi + ecx]
movzx eax, dl
mov edx, dword [ebp + 0xc]
movzx eax, byte [esi + eax]
xor byte [edi + edx], al
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x426f96
movzx eax, byte [ebp - 0xd]
mov edx, dword [ebp + 8]
mov byte [edx], al
movzx eax, byte [ebp - 0xe]
mov byte [edx + 1], al
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x426fe0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x11c
lea ebx, [eax + 2]
mov esi, dword [ebp + 8]
cmp esi, 0x100
ja 0x427071
mov byte [eax + 1], 0
xor ecx, ecx
mov byte [eax], 0
lea esi, [esi]
lea edi, [edi]
mov byte [ecx + ebx], cl
mov eax, ecx
xor edx, edx
div esi
movzx eax, byte [edi + edx]
mov byte [ecx + ebp - 0x118], al
inc ecx
cmp ecx, 0xff
jbe 0x427010
xor esi, esi
xor ecx, ecx
jmp 0x427040
movzx edx, byte [ecx + ebx]
movzx eax, dl
add eax, esi
add al, byte [ecx + ebp - 0x118]
movzx esi, al
movzx eax, byte [esi + ebx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, 0xff
mov byte [esi + ebx], dl
jbe 0x427040
add esp, 0x11c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.keybytes___256
mov ecx, 0x26
mov edx, str..._ssharcf.c
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll__assert
nop
push ebp
mov eax, 0x102
mov ebp, esp
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.00403a80
leave
ret
Function at 0x42ea80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x54], 0
pop ebp
ret

Function at 0x42f590
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov edx, 0x40
mov ebp, esp
push edi
mov eax, 0x36
push esi
lea esi, [ebp - 0x58]
push ebx
sub esp, 0x5c
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov ebx, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_memset
xor ecx, ecx
cmp ecx, edi
jge 0x42f5ea
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [ecx + ebx]
xor byte [ecx + ebp - 0x58], al
inc ecx
cmp ecx, edi
setl dl
xor eax, eax
cmp ecx, 0x3f
setle al
test edx, eax
jne 0x42f5d0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042ea80
mov dword [esp + 4], esi
mov eax, 0x40
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042eac0
mov dword [esp], esi
mov eax, 0x40
mov dword [esp + 8], eax
mov eax, 0x5c
mov dword [esp + 4], eax
call sub.msvcrt.dll_memset
xor ecx, ecx
cmp ecx, edi
jge 0x42f64a
lea esi, [esi]
movzx eax, byte [ecx + ebx]
xor byte [ecx + ebp - 0x58], al
inc ecx
cmp ecx, edi
setl dl
xor eax, eax
cmp ecx, 0x3f
setle al
test edx, eax
jne 0x42f630
mov ebx, dword [ebp + 8]
mov edi, esi
add ebx, 0x5c
mov dword [esp], ebx
call fcn.0042ea80
mov dword [esp + 4], esi
mov eax, 0x40
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0042eac0
cld
mov ecx, 0x10
xor eax, eax
rep stosd dword es:[edi], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x430480
Capabilities:
Encode data using base64

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
nop
movzx edx, byte [ecx + ebx]
mov al, dl
sub al, 0x41
cmp al, 0x19
ja 0x430520
movsx eax, dl
sub eax, 0x41
mov dword [ebp + ecx*4 - 0x28], eax
inc ecx
cmp ecx, 3
jle 0x430490
mov edx, dword [ebp - 0x28]
cmp edx, 0xffffffff
je 0x430571
mov ebx, dword [ebp - 0x24]
cmp ebx, 0xffffffff
je 0x430571
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xffffffff
je 0x430585
mov esi, dword [ebp - 0x1c]
mov edi, 3
cmp esi, 0xffffffff
je 0x43058f
shl edx, 0x12
and ecx, 0x3f
shl ebx, 0xc
shl ecx, 6
or edx, ebx
or edx, ecx
and esi, 0x3f
mov ecx, dword [ebp + 0xc]
or edx, esi
mov eax, edx
shr eax, 0x10
cmp edi, 1
mov byte [ecx], al
jg 0x43057b
cmp edi, 2
jle 0x430514
mov eax, dword [ebp + 0xc]
mov byte [eax + 2], dl
add esp, 0x1c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov al, dl
sub al, 0x61
cmp al, 0x19
ja 0x430533
movsx eax, dl
sub eax, 0x47
jmp 0x4304a6
mov al, dl
sub al, 0x30
cmp al, 9
jbe 0x430566
cmp dl, 0x2b
mov eax, 0x3e
je 0x4304a6
cmp dl, 0x2f
mov eax, 0x3f
je 0x4304a6
cmp dl, 0x3d
jne 0x430571
mov eax, 0xffffffff
jmp 0x4304a6
movsx eax, dl
add eax, 4
jmp 0x4304a6
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edx
shr eax, 8
mov byte [ecx + 1], al
jmp 0x430509
mov esi, dword [ebp - 0x1c]
xor eax, eax
cmp esi, 0xffffffff
jne 0x430573
cmp ecx, 0xffffffff
setne al
movzx edi, al
inc edi
jmp 0x4304e5
Function at 0x431d00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x453f29
push ebx
sub esp, 0x9c
mov eax, dword [str.PuTTY_User_Key_File_]
mov dword [ebp - 0x58], eax
mov eax, dword [0x453f2f]
mov dword [ebp - 0x54], eax
mov eax, dword [0x453f33]
mov dword [ebp - 0x50], eax
mov eax, dword [0x453f37]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x453f3b]
mov dword [ebp - 0x48], eax
movzx eax, byte [0x453f3f]
mov byte [ebp - 0x44], al
mov eax, dword [str._____BEGIN_SSH2_ENCRYPTED_PRIVAT]
mov dword [ebp - 0x88], eax
mov eax, dword [0x453f44]
mov dword [ebp - 0x84], eax
mov eax, dword [0x453f48]
mov dword [ebp - 0x80], eax
mov eax, dword [0x453f4c]
mov dword [ebp - 0x7c], eax
mov eax, dword [0x453f50]
mov dword [ebp - 0x78], eax
mov eax, dword [0x453f54]
mov dword [ebp - 0x74], eax
mov eax, dword [0x453f58]
mov dword [ebp - 0x70], eax
mov eax, dword [0x453f5c]
mov dword [ebp - 0x6c], eax
movzx eax, byte [0x453f60]
mov byte [ebp - 0x68], al
mov eax, dword [str._____BEGIN]
mov dword [esp + 4], esi
mov dword [ebp - 0x98], eax
mov eax, dword [0x453f65]
mov dword [ebp - 0x94], eax
mov eax, dword [0x453f69]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
xor ecx, ecx
test eax, eax
mov esi, eax
je 0x431e90
mov dword [esp + 0xc], eax
mov ecx, 1
mov ebx, 0x20
mov dword [esp + 4], ecx
lea eax, [ebp - 0x38]
mov dword [esp + 8], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll_fclose
xor ecx, ecx
test ebx, ebx
js 0x431e90
cmp ebx, 0x1f
mov ecx, 1
jle 0x431e90
cld
mov ecx, 0x20
mov edi, str.SSH_PRIVATE_KEY_FILE_FORMAT_1.1_n
lea esi, [ebp - 0x38]
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
cmp dl, al
mov ecx, 2
je 0x431e90
mov ecx, 0x14
lea edi, [ebp - 0x58]
lea esi, [ebp - 0x38]
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
cmp dl, al
mov ecx, 3
je 0x431e90
mov ecx, 0xb
lea edi, [ebp - 0x98]
lea esi, [ebp - 0x38]
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
cmp dl, al
mov ecx, 4
je 0x431e90
mov ecx, 0x20
lea edi, [ebp - 0x88]
lea esi, [ebp - 0x38]
repe cmpsb byte [esi], byte es:[edi]
setb al
seta dl
sub dl, al
movsx eax, dl
cmp eax, 1
sbb ecx, ecx
and ecx, 4
inc ecx
add esp, 0x9c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x432350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ecx, 1
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [esp + 4], ecx
mov dword [esp], 0x258
call fcn.00403a80
mov ebx, eax
call fcn.00431ef0
mov eax, dword [0x459cd8]
mov edx, 0x258
mov dword [esp], ebx
mov dword [esp + 8], edx
add eax, 0x459828
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov dword [esi], 0x258
mov dword [edi], ebx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp fcn.00431ef0
Function at 0x434230
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret
Function at 0x437750
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x58], 0
pop ebp
ret

Function at 0x437a90
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ecx, 0x40
mov ebp, esp
push edi
mov edi, edx
mov edx, 0x36
push esi
mov esi, eax
lea eax, [ebp - 0x58]
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memset
xor ecx, ecx
cmp ecx, ebx
jge 0x437aea
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [ecx + edi]
xor byte [ecx + ebp - 0x58], al
inc ecx
cmp ecx, ebx
setl dl
xor eax, eax
cmp ecx, 0x3f
setle al
test edx, eax
jne 0x437ad0
mov dword [esp], esi
call fcn.00437750
mov dword [esp], esi
mov eax, 0x40
mov dword [esp + 8], eax
lea eax, [ebp - 0x58]
mov dword [esp + 4], eax
call fcn.00437790
mov eax, 0x40
mov dword [esp + 8], eax
mov eax, 0x5c
mov dword [esp + 4], eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.msvcrt.dll_memset
xor ecx, ecx
cmp ecx, ebx
jge 0x437b4a
lea esi, [esi]
movzx eax, byte [ecx + edi]
xor byte [ecx + ebp - 0x58], al
inc ecx
cmp ecx, ebx
setl dl
xor eax, eax
cmp ecx, 0x3f
setle al
test edx, eax
jne 0x437b30
lea ebx, [esi + 0x60]
lea edi, [ebp - 0x58]
mov dword [esp], ebx
call fcn.00437750
mov dword [esp], ebx
mov eax, 0x40
mov dword [esp + 8], eax
lea eax, [ebp - 0x58]
mov dword [esp + 4], eax
call fcn.00437790
cld
mov ecx, 0x10
xor eax, eax
rep stosd dword es:[edi], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43b090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0x1c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00442850
test eax, eax
mov edx, 1
je 0x43b190
cmp eax, 2
je 0x43b1a0
dec eax
je 0x43b221
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
sub esp, 4
lea eax, [ebp - 0x3c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_GetConsoleMode
mov eax, dword [ebp - 0x3c]
sub esp, 8
mov dword [esp], ebx
or eax, 7
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetConsoleMode
sub esp, 8
lea eax, [ebp - 0x40]
xor ecx, ecx
mov dword [esp + 0xc], eax
mov edx, 0x1f
lea eax, [ebp - 0x38]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_ReadFile
mov eax, dword [ebp - 0x3c]
sub esp, 0x14
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetConsoleMode
movzx ecx, byte [ebp - 0x38]
sub esp, 8
test cl, cl
setne dl
xor eax, eax
cmp cl, 0xd
setne al
test edx, eax
je 0x43b1e0
cmp cl, 0xa
je 0x43b1e0
cmp cl, 0x79
sete al
cmp cl, 0x59
sete dl
or eax, edx
test al, 1
jne 0x43b1fd
mov edx, 1
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [0x459d70]
test eax, eax
je 0x43b23d
mov dword [esp + 0xc], ebx
mov eax, 0x454e00
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
xor edx, edx
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, 0x4550a4
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
xor edx, edx
jmp 0x43b1d0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00442f50
mov edx, 1
jmp 0x43b190
mov eax, dword [0x459d70]
test eax, eax
je 0x43b273
mov dword [esp + 8], esi
mov esi, 0x454c40
mov dword [esp + 0xc], ebx
mov dword [esp + 4], esi
jmp 0x43b1be
mov dword [esp + 0xc], ebx
mov eax, 0x454ee0
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
jmp 0x43b0df
mov dword [esp + 0xc], ebx
mov ebx, 0x454cc0
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
jmp 0x43b24e