joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x4b3470
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x4be510]
test eax, eax
jne 0x4b3494
mov ecx, 0xa2ce093f
call fcn.004b3f70
mov edx, 0x4fee74f4
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be510], eax
call eax
mov ebx, eax
mov eax, dword [0x4be284]
test eax, eax
jne 0x4b34bc
mov ecx, 0xa2ce093f
call fcn.004b3f70
mov edx, 0xafb2ca58
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be284], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x4b3572
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x4b3562
cmp ebx, 8
jb 0x4b3547
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x4b3506
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x4b3547
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x4b3520
cmp edx, ebx
jae 0x4b3562
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x4b3550
mov edx, dword [esp + 0x18]
test edx, edx
je 0x4b3570
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b35e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x4b3609
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x4be510]
test eax, eax
jne 0x4b362d
mov ecx, 0xa2ce093f
call fcn.004b3f70
mov edx, 0x4fee74f4
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be510], eax
call eax
mov edi, eax
mov eax, dword [0x4be284]
test eax, eax
jne 0x4b3655
mov ecx, 0xa2ce093f
call fcn.004b3f70
mov edx, 0xafb2ca58
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be284], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x4b36d5
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x4b36ca
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x4b3690
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4b36e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x4b370a
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x4be510]
test eax, eax
jne 0x4b372e
mov ecx, 0xa2ce093f
call fcn.004b3f70
mov edx, 0x4fee74f4
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be510], eax
call eax
mov edi, eax
mov eax, dword [0x4be284]
test eax, eax
jne 0x4b3756
mov ecx, 0xa2ce093f
call fcn.004b3f70
mov edx, 0xafb2ca58
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be284], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x4b37c2
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x4b37ba
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x4b3790
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4b3cc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp], 0x64bc
add dword [esp], 0xffff85b7
xor dword [esp], 0xe5a68224
shl dword [esp], 6
or dword [esp], 0x7fa52244
add dword [esp], 0x7bfd
shl dword [esp], 5
add dword [esp], 0xba34
xor dword [esp], 0xfff73254
mov dword [esp + 4], 0x1a8a
add dword [esp + 4], 0xffffd02b
shl dword [esp + 4], 0xe
xor dword [esp + 4], 0xfaad4006
push ebx
mov dword [esp + 8], 0xb8f9
mov ebx, ecx
xor dword [esp + 8], 0x3f0625fa
xor dword [esp + 8], 0x3f069d13
cmp byte [ebx], 0
je 0x4b3dad
push esi
push edi
jmp 0x4b3d40
mov edi, dword [esp + 0xc]
lea ebx, [ebx + 1]
mov dword [esp + 0x10], 0x1a8a
add dword [esp + 0x10], 0xffffd02b
shl dword [esp + 0x10], 0xe
xor dword [esp + 0x10], 0xfaad4006
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], 0xb8f9
xor dword [esp + 0x10], 0x3f0625fa
xor dword [esp + 0x10], 0x3f069d13
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
movsx eax, byte [ebx - 1]
mov dword [esp + 0xc], eax
add dword [esp + 0xc], esi
shl edx, cl
add dword [esp + 0xc], edx
sub dword [esp + 0xc], edi
cmp byte [ebx], 0
jne 0x4b3d40
pop edi
pop esi
mov eax, dword [esp + 4]
pop ebx
add esp, 8
ret
Function at 0x4b3ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x4b3f2c
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.004b3cc0
xor eax, 0xbdb9b51
cmp eax, dword [esp + 0x10]
je 0x4b3f36
inc esi
cmp esi, dword [edi + 0x18]
jb 0x4b3f10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x4b3f64
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x4b3f64
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x4b40d0
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x4b40f6
cmp al, 0x2e
je 0x4b40f3
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x4b40e3
jmp 0x4b40f6
mov byte [edx], 0
mov eax, dword [0x4be430]
test eax, eax
jne 0x4b411a
mov ecx, 0xa2ce093f
call fcn.004b3f70
mov edx, 0xfce32466
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be430], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x4b4161
mov eax, dword [0x4be344]
test eax, eax
jne 0x4b414b
mov ecx, 0xa2ce093f
call fcn.004b3f70
mov edx, 0xd4f020bd
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be344], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x4b4161
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.004b3cc0
xor eax, 0xbdb9b51
mov ecx, edi
mov edx, eax
call fcn.004b3ed0
pop edi
pop esi
add esp, 0x104
ret
Function at 0x4b3f70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [esp + 0xc], ecx
push ebx
push ebp
mov ecx, dword [eax + 0xc]
add ecx, 0xc
push esi
push edi
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx]
cmp ebx, ecx
je 0x4b40b5
mov edx, dword [ebx + 0x30]
mov dword [esp + 0x10], 0x64bc
add dword [esp + 0x10], 0xffff85b7
xor dword [esp + 0x10], 0xe5a68224
shl dword [esp + 0x10], 6
or dword [esp + 0x10], 0x7fa52244
add dword [esp + 0x10], 0x7bfd
shl dword [esp + 0x10], 5
add dword [esp + 0x10], 0xba34
xor dword [esp + 0x10], 0xfff73254
mov dword [esp + 0x14], 0x1a8a
add dword [esp + 0x14], 0xffffd02b
shl dword [esp + 0x14], 0xe
xor dword [esp + 0x14], 0xfaad4006
mov dword [esp + 0x14], 0xb8f9
xor dword [esp + 0x14], 0x3f0625fa
xor dword [esp + 0x14], 0x3f069d13
cmp word [edx], 0
je 0x4b409c
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x14], 0x1a8a
add dword [esp + 0x14], 0xffffd02b
shl dword [esp + 0x14], 0xe
xor dword [esp + 0x14], 0xfaad4006
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x14], 0xb8f9
xor dword [esp + 0x14], 0x3f0625fa
xor dword [esp + 0x14], 0x3f069d13
shl esi, cl
movzx ecx, byte [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx eax, word [edx]
shl edi, cl
cmp eax, 0x41
jb 0x4b407f
cmp eax, 0x5a
ja 0x4b407f
add eax, 0x20
mov dword [esp + 0x10], eax
add edx, 2
add dword [esp + 0x10], esi
add dword [esp + 0x10], edi
sub dword [esp + 0x10], ebp
cmp word [edx], 0
jne 0x4b4020
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
xor eax, 0x2db0ef4d
cmp eax, dword [esp + 0x1c]
je 0x4b40bf
mov ebx, dword [ebx]
cmp ebx, ecx
jne 0x4b3f95
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebx + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4b4390
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x4b452e
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x4b452e
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x4b452e
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x4b452e
mov eax, dword [0x4bdfd0]
test eax, eax
jne 0x4b43fb
mov ecx, 0xa2ce093f
call fcn.004b3f70
mov edx, 0x320a3d1b
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4bdfd0], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x4b4525
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x4be5a0]
test eax, eax
jne 0x4b445b
mov ecx, 0xff9ecf59
call fcn.004b3f70
mov edx, 0x36664426
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be5a0], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x4b44de
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x4be5a0]
test eax, eax
jne 0x4b44c6
mov ecx, 0xff9ecf59
call fcn.004b3f70
mov edx, 0x36664426
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be5a0], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x4b4485
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.004b4660
mov edx, edi
mov ecx, ebx
call fcn.004b4570
pop esi
test eax, eax
jne 0x4b4525
mov eax, dword [0x4be3d0]
test eax, eax
jne 0x4b4519
mov ecx, 0xa2ce093f
call fcn.004b3f70
mov edx, 0xf1294406
mov ecx, eax
call fcn.004b3ed0
mov dword [0x4be3d0], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
Function at 0x401000
Capabilities:
Delete file

Disassembly:
sub esp, 0xc8
lea eax, [esp]
push eax
call fcn.004013c0
add esp, 4
test eax, eax
jne 0x401024
push eax
push str.Secure_Shell_Setup:_Error
push str.Error_generating_temporary_setup_name.
jmp 0x40107c
lea ecx, [esp]
push ecx
call fcn.004010a0
add esp, 4
test eax, eax
jne 0x401042
push eax
push str.Secure_Shell_Setup:_Error
push str.Error_extracting_the_setup_executable.
jmp 0x40107c
call fcn.00401120
test eax, eax
jne 0x401058
push eax
push str.Secure_Shell_Setup:_Error
push str.Error_extracting_the_license.
jmp 0x40107c
mov edx, dword [esp + 0xd4]
lea eax, [esp]
push edx
push eax
call fcn.00401490
add esp, 8
test eax, eax
jne 0x401084
push eax
push str.Secure_Shell_Setup:_Error
push str.Error_launching_the_setup_executable.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00401290
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
add esp, 0xc8
ret 0x10

Function at 0x4010a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push str.SSHSETUP
push 0x12d
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4010bd
pop edi
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, 0x3e8
jae 0x4010d5
pop edi
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4010e7
pop edi
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x4010fe
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [esp + 0xc]
push ecx
push edi
push eax
call fcn.00401380
add esp, 0xc
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
ret
Function at 0x401120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push str.SSHLICENSE
push 0x12e
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40113d
pop esi
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x40114d
pop esi
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x40115f
pop esi
pop ebx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401178
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
xor eax, eax
pop ebx
ret
push edi
push 6
push esi
push str.SSHLIC
call fcn.00401670
add esp, 0xc
test eax, eax
je 0x40119c
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
ret
lea edi, [esi + 0xf]
push 0xa
push edi
push str.0000000000
call fcn.00401670
add esp, 0xc
test eax, eax
jne 0x4011c5
push ebx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
ret
push edi
call fcn.0040165b
add esp, 4
test eax, eax
jg 0x4011e1
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
ret
add esi, 0x1b
push eax
push esi
call fcn.00401200
add esp, 8
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x401200
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 0x20006
push 0
push str.Software
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401227
xor eax, eax
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 4]
push ecx
push str.SSH_Communications_Security
push edx
call esi
test eax, eax
je 0x401247
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push eax
push 0x408118
push ecx
call esi
test eax, eax
je 0x401261
xor eax, eax
pop esi
pop ecx
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
push edx
push eax
push 1
push 0
push str.License
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop esi
inc eax
pop ecx
ret
Function at 0x401290
Capabilities:
Set registry value

Disassembly:
sub esp, 0x1f8
lea eax, [esp + 4]
push esi
push edi
push 0x1f4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4012b7
pop edi
pop esi
add esp, 0x1f8
ret
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.004016b0
add esp, 8
test eax, eax
je 0x4012cd
mov byte [eax], 0
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
push edx
push 0x20006
not ecx
push eax
dec ecx
push str.Software
push 0x80000001
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401307
pop edi
xor eax, eax
pop esi
add esp, 0x1f8
ret
mov ecx, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 8]
push eax
push str.SSH_Communications_Security
push ecx
call edi
test eax, eax
je 0x40132d
pop edi
xor eax, eax
pop esi
add esp, 0x1f8
ret
mov eax, dword [esp + 8]
lea edx, [esp + 8]
push edx
push 0x408118
push eax
call edi
test eax, eax
je 0x40134d
pop edi
xor eax, eax
pop esi
add esp, 0x1f8
ret
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push esi
push ecx
push 1
push 0
push str.SetupPath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x1f8
ret

Function at 0x4013c0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push edi
push eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40140e
mov edi, str.C:SSHPackage.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 8]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x190
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, 1
lea ecx, [esp + 8]
push esi
push ecx
lea edx, [esp + 0xd8]
push str._sSSHPackage_d.exe
push edx
call fcn.0040186a
add esp, 0x10
lea eax, [esp + 0xd0]
push eax
call edi
cmp eax, 0xffffffff
je 0x401454
inc esi
cmp esi, 0x14
jl 0x401419
pop edi
xor eax, eax
pop esi
add esp, 0x190
ret
lea edi, [esp + 0xd0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x19c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x190
ret
Function at 0x401490
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x1f94
call fcn.004018c0
push ebp
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
mov edi, 0x408190
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x60]
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [esp + 0x1c], 0x44
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1fa4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x48], 1
mov ebp, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x60]
and ecx, 3
mov word [esp + 0x4c], 1
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40818c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x60]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1fa8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x7c]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4015a0
pop edi
pop esi
pop ebp
add esp, 0x1f94
ret
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0xc]
push edx
call esi
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1f94
ret
Function at 0x4039c5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408470
cmp edx, dword [eax]
je 0x4039e7
add eax, 8
inc ecx
cmp eax, 0x408500
jl 0x4039d8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408470]
jne 0x403b15
mov eax, dword [0x40aa38]
cmp eax, 1
je 0x403aef
test eax, eax
jne 0x403a18
cmp dword [0x4081a4], 1
je 0x403aef
cmp edx, 0xfc
je 0x403b15
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403a4f
lea eax, [ebp - 0x1a4]
push 0x407488
push eax
call fcn.00405880
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405280
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x403a92
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405280
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x407484
push edi
call fcn.00405d70
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x407468
push eax
call fcn.00405880
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405890
lea eax, [ebp - 0xa0]
push 0x407464
push eax
call fcn.00405890
push dword [esi + 0x408474]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405890
push 0x12010
lea eax, [ebp - 0xa0]
push 0x40743c
push eax
call fcn.00405ce0
add esp, 0x2c
pop edi
jmp 0x403b15
lea eax, [ebp + 8]
lea esi, [esi + 0x408474]
push 0
push eax
push dword [esi]
call fcn.00405280
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x944000
Capabilities:
Accept command line arguments
Packed with generic packer
Terminate process

Disassembly:
pushal
push 0x944031
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x94403a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [0x944047]
push 0
push 0
push 0
push edx
push 0
push 0
call eax
popal
jmp fcn.004018ef