joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4071e0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff34
mov esi, eax
xor ebx, ebx
push 0
push esi
call fcn.00406d34
mov dword [0x40f7fc], eax
cmp dword [0x40f7fc], 0
je 0x407278
cmp dword [0x40f804], 0
je 0x407278
mov eax, dword [0x40f7fc]
push eax
call sub.kernel32.dll_SuspendThread
mov dword [esp], 0x10007
push esp
mov eax, dword [0x40f7fc]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x40725f
push esi
lea esi, [esp + 4]
mov edi, 0x40f808
mov ecx, 0x33
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [0x40f804]
mov dword [esp + 0xb8], eax
mov dword [esp], 0x10007
push esp
mov eax, dword [0x40f7fc]
push eax
call sub.kernel32.dll_SetThreadContext
mov eax, dword [0x40f7fc]
push eax
call sub.kernel32.dll_ResumeThread
push 0
push 0
push 0
push esi
call sub.user32.dll_PostThreadMessageA
mov bl, 1
mov eax, ebx
add esp, 0xcc
pop edi
pop esi
pop ebx
ret

Function at 0x4072f8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x4073b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0040317c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jbe 0x407396
mov eax, ebx
call fcn.00402494
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10]
mov eax, 0x4073cc
call fcn.00404d24
mov eax, dword [ebp - 0x10]
call fcn.004035bc
push eax
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40738d
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.00404814
mov edx, ebx
mov eax, esi
call fcn.004024b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4073bb
lea eax, [ebp - 0x10]
call fcn.0040317c
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x407694
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x407745
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004073f0
xor edx, edx
mov eax, 0xf
call fcn.00405aec
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.00405b0c
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x407725
push ebp
mov eax, dword [esi + 8]
call fcn.00407440
pop ecx
test al, al
je 0x407716
mov eax, dword [esi + 8]
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x407729
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle
jmp 0x407729
mov edx, esi
mov eax, ebx
call fcn.00405b2c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4076e5
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40774c
lea eax, [ebp - 4]
call fcn.0040317c
ret

Function at 0x407a7c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
lea edi, [ebp - 0x12d]
xor eax, eax
push ebp
push 0x407bf8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0xf
call fcn.00405aec
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00405b0c
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x407bc4
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004033a4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040477c
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.00404744
test eax, eax
je 0x407b3e
lea eax, [ebp - 0x13c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004033a4
mov eax, dword [ebp - 0x13c]
mov edx, dword [ebp - 4]
call fcn.00404744
test eax, eax
jne 0x407bb5
mov eax, dword [edi + 8]
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x407b6a
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x407b6e
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
jne 0x407bb5
call fcn.00407a54
test al, al
jne 0x407bb5
mov edx, dword [edi + 8]
mov eax, 1
call fcn.0040793c
mov ebx, eax
test ebx, ebx
je 0x407bb5
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 5], 0
jne 0x407bb5
mov eax, dword [edi + 8]
call fcn.00407284
mov edx, edi
mov eax, esi
call fcn.00405b2c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x407ae3
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407bff
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.004031a0
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x408408
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe2c
mov dword [esp], eax
mov edi, 0x40f9a4
lea eax, [esp + 0x44]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [esp]
call fcn.0040317c
push 0x40
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4084a2
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x408496
test ebx, ebx
jne 0x408466
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [esp]
call fcn.00404814
mov eax, dword [edi]
call fcn.00403c7c
inc eax
push eax
mov eax, edi
mov ecx, 1
mov edx, dword [0x408394]
call fcn.00403e38
add esp, 4
mov eax, dword [edi]
call fcn.00403c84
mov edx, dword [edi]
mov ecx, dword [esi + ebx*4]
mov ecx, dword [ecx]
mov dword [edx + eax*4], ecx
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
jne 0x408452
call sub.wsock32.dll_WSACleanup
add esp, 0x1d4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408b10
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x408b18
xor eax, eax
push ebp
push 0x408c49
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00407754
lea eax, [ebp - 8]
mov edx, 0x408c5c
call fcn.00403214
push 0x408c6c
push dword [ebp - 8]
push 0x408c7c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040347c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00404d24
mov eax, dword [ebp - 0xc]
call fcn.00407a7c
lea eax, [ebp - 8]
mov edx, 0x408c88
call fcn.00403214
lea eax, [ebp - 0x18]
mov ecx, 0x408c98
mov edx, dword [ebp - 8]
call fcn.00403408
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00404d24
mov eax, dword [ebp - 0x14]
call fcn.00407a7c
lea eax, [ebp - 8]
mov edx, 0x408ca8
call fcn.00403214
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, 0x408cb4
call fcn.00403408
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00404d24
mov eax, dword [ebp - 0x1c]
call fcn.00407a7c
lea eax, [ebp - 8]
mov edx, 0x408cc4
call fcn.00403214
push 0
push 0x408cdc
push dword [ebp - 8]
push 0x408cf0
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.0040347c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00404d24
mov eax, dword [ebp - 0x24]
call fcn.004035bc
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x408a80
push 0
push 0
call sub.kernel32.dll_CreateThread
push 0x3e8
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408c50
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.004031a0
ret
Function at 0x40a398
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40a41a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
mov edx, 0x44
call fcn.00404574
mov dword [ebp - 0x48], 0x44
mov word [ebp - 0x18], 1
test ebx, ebx
jne 0x40a3db
lea ebx, [ebp - 0x58]
push ebx
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a421
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x40af44
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40afe1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 0xc]
call fcn.0040317c
mov eax, dword [ebp - 4]
call fcn.004035bc
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x40afcb
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x40afbf
test ebx, ebx
jne 0x40afbe
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [ebp - 0xc]
call fcn.00404814
mov eax, dword [esi + ebx*4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx], eax
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x40afa1
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40afe8
lea eax, [ebp - 4]
call fcn.0040317c
ret

Function at 0x40b384
Capabilities:
Read file via mapping

Disassembly:
push ebx
xor ebx, ebx
push 0x40b3e8
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x40f9c0], eax
cmp dword [0x40f9c0], 0
je 0x40b3a7
mov bl, 1
jmp 0x40b3c3
push 0x40b3e8
push 0x4054
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x40f9c0], eax
push 0
push 0
push 0
push 6
mov eax, dword [0x40f9c0]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x40f9c4], eax
test bl, bl
jne 0x40b3e4
call fcn.0040bd7c
mov eax, ebx
pop ebx
ret
Function at 0x40b3f8
Capabilities:
Clear file content
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x40b400
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40b5b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GetLocalTime
lea edx, [ebp - 0x24]
movzx eax, word [ebp - 0x20]
call fcn.00404828
push dword [ebp - 0x24]
push 0x40b5cc
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 0x1e]
call fcn.00404828
push dword [ebp - 0x28]
push 0x40b5cc
lea edx, [ebp - 0x2c]
movzx eax, word [ebp - 0x1a]
call fcn.00404828
push dword [ebp - 0x2c]
lea eax, [ebp - 8]
mov edx, 5
call fcn.0040347c
lea eax, [ebp - 0x10]
mov ecx, dword [0x41c21c]
mov edx, dword [ebp - 4]
call fcn.00403408
mov eax, dword [ebp - 0x10]
call fcn.00404afc
test al, al
je 0x40b536
mov eax, dword [ebp - 0x10]
call fcn.004035bc
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00403374
mov eax, dword [ebp - 0x30]
mov edx, 2
call fcn.00404b0c
mov esi, eax
cmp esi, 0xffffffff
je 0x40b58b
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov edx, eax
mov eax, 0x1e
call fcn.0040c208
mov edi, eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.004036ec
mov eax, dword [ebp - 0xc]
call fcn.004035bc
mov edx, eax
mov ecx, edi
mov eax, esi
call fcn.00404638
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00403508
jne 0x40b502
xor ebx, ebx
jmp 0x40b52e
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00404950
mov eax, dword [ebp - 8]
call fcn.004033bc
push eax
mov eax, dword [ebp - 8]
call fcn.004035bc
mov edx, eax
mov eax, esi
pop ecx
call fcn.00404980
push esi
call sub.kernel32.dll_SetEndOfFile
push esi
call sub.kernel32.dll_CloseHandle
jmp 0x40b58b
mov eax, dword [ebp - 0x10]
call fcn.0040495c
mov esi, eax
cmp esi, 0xffffffff
je 0x40b589
mov eax, dword [ebp - 8]
call fcn.004033bc
push eax
mov eax, dword [ebp - 8]
call fcn.004035bc
mov edx, eax
mov eax, esi
pop ecx
call fcn.00404980
push esi
call sub.kernel32.dll_CloseHandle
push 6
lea eax, [ebp - 0x34]
mov ecx, dword [0x41c21c]
mov edx, dword [ebp - 4]
call fcn.00403408
mov eax, dword [ebp - 0x34]
call fcn.004035bc
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x40b58b
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b5ba
lea eax, [ebp - 0x34]
mov edx, 5
call fcn.004031a0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004031a0
ret
Function at 0x40d1ec
Capabilities:
Get file size
Read file on windows
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40d36d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00404b0c
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40d357
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0x1000000
jae 0x40d351
cmp esi, dword [0x40f9c8]
jl 0x40d27c
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [0x40f9b0]
push eax
push ebx
call sub.kernel32.dll_ReadFile
mov eax, dword [0x40e200]
mov eax, dword [eax]
call fcn.004035bc
mov ecx, eax
mov eax, dword [0x40f9b0]
mov edx, esi
call fcn.004083b8
test eax, eax
sete al
jmp 0x40d27e
mov al, 1
test al, al
je 0x40d351
mov eax, esi
call fcn.00402494
mov edi, eax
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov edx, edi
mov ecx, esi
mov eax, ebx
call fcn.00404638
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_GetFileTime
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov edx, dword [0x40f9b4]
mov ecx, dword [0x40f9c8]
mov eax, ebx
call fcn.00404980
mov edx, edi
mov ecx, esi
mov eax, ebx
call fcn.00404980
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, edi
call fcn.00405484
test al, al
je 0x40d336
cmp dword [ebp - 0x28], 0
jbe 0x40d336
cmp dword [ebp - 0x2c], 0
je 0x40d336
mov esi, dword [0x40f9bc]
sub esi, dword [0x40f9b4]
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_SetFilePointer
cmp esi, eax
jne 0x40d336
mov edx, dword [ebp - 0x28]
mov eax, dword [0x40f9b8]
call fcn.0040c208
mov ecx, eax
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.00404980
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
mov edx, esi
mov eax, edi
call fcn.004024b4
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d374
lea eax, [ebp - 4]
call fcn.0040317c
ret
Function at 0x40d40c
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.004035ac
mov eax, dword [ebp - 0x18]
call fcn.004035ac
mov eax, dword [ebp - 0x1c]
call fcn.004035ac
xor eax, eax
push ebp
push 0x40d510
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x14]
call fcn.004035bc
push eax
mov eax, dword [ebp - 0x18]
call fcn.004035bc
mov edx, eax
mov eax, dword [0x40f650]
pop ecx
call fcn.0040d394
pop ecx
test al, al
je 0x40d4f5
mov eax, dword [ebp - 0x1c]
call fcn.00404afc
test al, al
je 0x40d486
mov eax, dword [ebp - 0x1c]
call fcn.004035bc
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
push ebp
push 0x40d4da
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x1c]
call fcn.004035bc
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d4e4
mov eax, dword [ebp - 0x10]
call fcn.0040457c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d517
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004031a0
ret
Function at 0x401170
Capabilities:
Delete directory

Disassembly:
sub esp, 0x2c
mov eax, dword [0x416080]
test eax, eax
je 0x401189
call sub.cygwin1.dll_getpid
cmp eax, dword [0x416080]
jne 0x4011d7
mov dword [esp + 0x18], str.cleanup
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 5
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x933
mov dword [esp + 4], str.cleanup_socket
mov dword [esp], str.ssh_agent.c
call sub.cygopenssh.dll_sshlog
cmp byte [0x415080], 0
jne 0x4011f8
cmp byte [0x414080], 0
jne 0x4011e0
add esp, 0x2c
xor eax, eax
ret
mov dword [esp], 0x414080
call sub.cygwin1.dll_rmdir
add esp, 0x2c
xor eax, eax
ret
mov dword [esp], 0x415080
call sub.cygwin1.dll_unlink
jmp 0x4011ce

Function at 0x401210
Capabilities:
Terminate process
Write file on windows

Disassembly:
sub esp, 0x1c
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x12e
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.usage:_ssh_agent___c___s____Dd____a_bind_address____E_fingerprint_hash__n___________________O_option____P_allowed_providers____t_life__n_______ssh_agent___a_bind_address____E_fingerprint_hash____O_option__n___________________P_allowed_providers____t_life__command__arg_...__n_______ssh_agent___c___s___k_n
call sub.cygwin1.dll_fwrite
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
nop
sub esp, 0x1c
call fcn.00401170
call fcn.00408cf0
mov dword [esp], 2
call sub.cygwin1.dll__exit
lea esi, [esi]
Function at 0x408150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp], edx
call sub.cygopenssh.dll_sshbuf_len
cmp esi, 0xffffffff
je 0x4081ec
mov edi, eax
bswap eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], sub.cygwin1.dll_write
call sub.cygopenssh.dll_atomicio
cmp eax, 4
je 0x408208
mov dword [esp + 0x18], str.write_to_helper_failed
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xc4
mov dword [esp + 4], str.send_msg
mov dword [esp], str.ssh_pkcs11_client.c
call sub.cygopenssh.dll_sshlog
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.cygopenssh.dll_sshbuf_consume
test eax, eax
jne 0x40824b
mov eax, dword [esp + 0x2c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x408246
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
xor eax, eax
mov edx, eax
ret
mov dword [esp], ebx
call sub.cygopenssh.dll_sshbuf_len
mov dword [esp], ebx
mov ebp, eax
call sub.cygopenssh.dll_sshbuf_mutable_ptr
mov dword [esp + 4], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov dword [esp], sub.cygwin1.dll_write
call sub.cygopenssh.dll_atomicio
mov dword [esp], ebx
mov esi, eax
call sub.cygopenssh.dll_sshbuf_len
cmp esi, eax
jne 0x4081a0
jmp 0x4081dc
call sub.cygwin1.dll___stack_chk_fail
mov dword [esp], eax
call sub.cygopenssh.dll_ssh_err
mov dword [esp + 0x18], str.consume
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0xc6
mov dword [esp + 4], str.send_msg
mov dword [esp], str.ssh_pkcs11_client.c
call sub.cygopenssh.dll_sshfatal
lea esi, [esi]
nop
Function at 0x40b870
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [sym.imp.cygwin1.dll___progname]
mov dword [esp], eax
call sub.cygwin1.dll_strdup
test eax, eax
je 0x40b888
add esp, 0x1c
ret
mov dword [esp], str.strdup
call sub.cygwin1.dll_perror
mov dword [esp], 1
call sub.cygwin1.dll_exit
xor eax, eax
ret
Function at 0x406c81
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x406cbf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406c95
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x406c90
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406cec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ccd
not eax
pop ebp
ret 0xc

Function at 0x5929dd
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jne 0x5c2369
inc di
mov edi, dword [edx + 0x24]
stc
pushal
pushfd
clc
add edi, eax
stc
cmc
call fcn.00598157
pop esi
inc ecx
shl esi, cl
imul dword [esi + 0x5f5815c]
clc
mov eax, 0xa4a1a0fa
test byte [edx - 0x7ac8189c], ah
jo 0x592a43
adc ah, byte [ecx - 0x67a9d98d]
inc edx
jmp 0x95d0693f
or byte [ebx + 0x2ab6e2b7], bh
xchg ebp, eax
xor al, 0x98
xchg byte [edi - 0x3d86c91d], bl
enter 0x6040, 0xffffffffffffffb4
jno 0x592a67
fsub qword [edi]
iretd
sub eax, 0x4df6ed
nop
and ebx, esp
insd dword es:[edi], dx
adc eax, 0x2a088b48
adc dl, byte [edx]
push esp
call [edi]
xor dh, byte [ebp - 0xe]
out dx, eax
mov bl, 0x3e
xchg edi, eax
popal
lodsb al, byte [esi]
pushal
dec esp
fcomp qword [esi]
mov al, byte cs:[0xb9a9c5cb]
or eax, 0xf505e4a4
dec ebp
invalid

Function at 0x403910
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fe], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404670], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404604], eax
mov dword [0x4040f6], eax
mov dword [0x4045f0], 0x30
mov dword [0x4045f4], 2
jmp 0x403955
mov dword [0x4045f8], 0x402f69
mov dword [0x4045fc], 0
mov dword [0x404600], 0
mov dword [0x404618], 0x404564
mov dword [0x404610], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404608], eax
mov dword [0x40461c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40460c], eax
push 0x4045f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040f6]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push str.first
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404668], eax
push 5
push dword [0x404668]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404668]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404620]
jmp 0x403a29
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a1b
mov eax, dword [0x404628]
jmp 0x403a44
call 0x402a90
ret