joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de29
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x47d104]
test eax, eax
je 0x40de7e
movzx eax, byte [0x47d108]
test al, al
je 0x40de7e
mov eax, dword [0x47d10c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x12
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x10
mov eax, dword [0x47d104]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
mov eax, dword [0x47d104]
mov dword [esp], eax
call sym._safefree
mov dword [0x47d104], 0
mov byte [0x47d108], 0
nop
leave
ret

Function at 0x40df7e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [0x47d109]
test al, al
je 0x40dfb8
mov eax, dword [0x47d10c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x12
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x10
mov eax, dword [0x47d104]
test eax, eax
je 0x40dfde
movzx eax, byte [0x47d108]
test al, al
je 0x40dfde
mov eax, dword [0x47d104]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
nop
leave
ret

Function at 0x40ea9a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
jmp 0x40eb17
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, edx
sub ecx, eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add edx, eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
call sym._fread
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._ferror
test eax, eax
je 0x40eb00
mov eax, 2
jmp 0x40eb88
cmp dword [ebp - 0x10], 0
je 0x40eb29
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
add edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp edx, eax
jb 0x40eaac
jmp 0x40eb2a
nop
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp edx, eax
jne 0x40eb58
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fgetc
cmp eax, 0xffffffff
je 0x40eb58
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._make_ptrlen_1
mov ecx, dword [ebp + 8]
add ecx, 0xc
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ecx
call sym._BinarySource_INIT__
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40f6bb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 1
mov dword [esp + 4], 0x461204
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._f_open
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40f6ec
mov eax, 0
jmp 0x40f759
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._rsa1_save_sb
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._fwrite
mov edx, eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
cmp edx, eax
sete al
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
test eax, eax
je 0x40f74a
mov byte [ebp - 9], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strbuf_free
movzx eax, byte [ebp - 9]
leave
ret

Function at 0x411e87
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 1
mov dword [esp + 4], 0x461204
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._f_open
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x411eb8
mov eax, 0
jmp 0x411f2c
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._ppk_save_sb
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._fwrite
mov edx, eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
cmp edx, eax
sete al
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
test eax, eax
je 0x411f1d
mov byte [ebp - 9], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strbuf_free
movzx eax, byte [ebp - 9]
leave
ret
Function at 0x4121ee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0x18], 9
jne 0x412393
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 1
mov dword [esp], str._____BEGIN_SSH2_PUBLIC_KEY______n
call sym._fwrite
cmp dword [ebp + 0xc], 0
je 0x4122cc
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 1
mov dword [esp], str.Comment:__
call sym._fwrite
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x41229f
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x5c
je 0x412270
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x22
jne 0x412283
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x5c
call sym._fputc
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputc
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x41225c
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4617c0
call sym._fwrite
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x41234d
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp - 0x10]
mov edx, 3
cmp eax, edx
cmovg eax, edx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add edx, eax
lea eax, [ebp - 0x25]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._base64_encode_atom
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x10], eax
mov byte [ebp - 0x21], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x25]
mov dword [esp], eax
call sym._fputs
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0xf
jle 0x41234d
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x14]
jl 0x4122dc
cmp dword [ebp - 0x14], 0
jle 0x41236e
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str._____END_SSH2_PUBLIC_KEY______n
call sym._fwrite
jmp 0x4123fa
cmp dword [ebp + 0x18], 0xa
jne 0x4123dc
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._ssh2_pubkey_openssh_str_internal
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x461776
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._safefree
jmp 0x4123fa
mov dword [esp + 8], 0x6ae
mov dword [esp + 4], str.E:GitcnPuTTY_TEMP1_sshpubk.c
mov dword [esp], str.false___ssh2_write_pubkey
mov eax, dword [sym.imp.ucrtbase.dll__assert]
call eax
leave
ret
Function at 0x41c931
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x1c], al
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
lea eax, [ebp - 0x14]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x14], 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
cmp byte [ebp - 0x1c], 0
je 0x41c97b
mov ecx, 0x40080003
jmp 0x41c980
mov ecx, 0x40000003
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
lea edx, [ebp - 0x14]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x1000
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], 8
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
call eax
sub esp, 0x20
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
cmp eax, 0xffffffff
setne al
leave
ret

Function at 0x41ca21
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x1c], al
cmp byte [ebp - 0x1c], 0
je 0x41ca40
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
jmp 0x41ca81
mov eax, dword [ebp + 8]
lea edx, [eax + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
call eax
sub esp, 8
test eax, eax
je 0x41ca6a
mov dword [ebp - 0xc], 0
jmp 0x41ca74
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
je 0x41cb61
cmp dword [ebp - 0xc], 0
je 0x41ca90
cmp dword [ebp - 0xc], 0x217
jne 0x41caf8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
mov edx, dword [ebp - 0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], sym._named_pipe_accept
mov dword [esp], eax
call sym._plug_accepting_1
test eax, eax
je 0x41cad0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._create_named_pipe
xor eax, 1
test al, al
je 0x41ca2d
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._win_strerror
mov dword [esp + 4], eax
mov dword [esp], str.Error_while_listening_to_named_pipe:__s
call sym._dupprintf
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._sk_namedpipe_addr
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x28]
mov ecx, dword [ebp - 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edx
call sym._plug_log_1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._safefree
jmp 0x41cb62
nop
leave
ret
Function at 0x41d04a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
and eax, 1
test eax, eax
je 0x41d099
lea eax, [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x41d0a0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x11]
test al, al
je 0x41d0d9
mov eax, dword [ebp - 0x18]
add eax, 4
mov dword [esp], eax
call sym._add_to_ready_list
jmp 0x41d1ff
cmp dword [ebp - 0xc], 0
je 0x41d103
mov dword [esp + 8], 0x14
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x18]
lea esi, [eax + 0x24]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ebx, dword [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
setne al
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor eax, 1
test al, al
je 0x41d15e
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x28], edx
jmp 0x41d168
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x28], 0
cmp dword [ebp - 0xc], 0
je 0x41d1e0
movzx eax, byte [ebp - 0x11]
xor eax, 1
test al, al
je 0x41d1e0
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0x3e5
jne 0x41d1e0
mov eax, dword [ebp - 0x18]
lea edx, [eax + 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
call eax
sub esp, 0x10
test eax, eax
setne al
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
xor eax, 1
test al, al
je 0x41d1d6
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x28], edx
jmp 0x41d1e0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x28], 0
mov eax, dword [ebp - 0x18]
add eax, 4
mov dword [esp], eax
call sym._add_to_ready_list
movzx eax, byte [ebp - 0x11]
xor eax, 1
test al, al
jne 0x41d1fe
jmp 0x41d0a0
nop
cmp dword [ebp - 0xc], 0
je 0x41d215
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, 0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x41d4b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 0x102c
mov dword [esp], 1
call sym._safemalloc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x1028], edx
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x16], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x15], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x1c], edx
call sym._ensure_ready_event_setup
mov eax, dword [ebp - 0xc]
lea edx, [eax + 4]
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], sym._handle_input_threadfunc_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41d5a9
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17], 1
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x41d5b5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 0x102c
mov dword [esp], 1
call sym._safemalloc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x16], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x15], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0xc]
add eax, 0x30
mov dword [esp], eax
call sym._bufchain_init
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x44], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x48], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x4c], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x1c], edx
call sym._ensure_ready_event_setup
mov eax, dword [ebp - 0xc]
lea edx, [eax + 4]
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], sym._handle_output_threadfunc_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41d6cb
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x41feca
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 0x10]
imul eax, eax, 0x3e8
mov edx, 0x10624dd3
mul edx
mov eax, edx
shr eax, 6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov edx, dword [ebp + 0x3c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp + 0x34]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x2c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._argon2
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jae 0x41ff85
mov eax, dword [ebp - 0x10]
not eax
cmp eax, dword [ebp - 0xc]
jae 0x41ff8f
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
jmp 0x41ffae
mov eax, dword [ebp + 0x40]
mov dword [esp], eax
call sym._strbuf_clear_2
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0x41fef6
leave
ret
Function at 0x425593
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
sub eax, 0x18
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
cmp edx, eax
jae 0x425610
call sym._strbuf_new_nm
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strbuf_append
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ecx
call sym._hash_simple
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
jmp 0x42561c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._ssh_hash_reset_1
mov dword [ebp - 0x18], 0
jmp 0x42565d
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
add eax, edx
movzx eax, byte [eax]
xor eax, 0x5c
movzx edx, al
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._BinarySink_put_byte
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jb 0x425633
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
jmp 0x42568a
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sym._BinarySink_put_byte
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
cmp dword [ebp - 0x1c], eax
jb 0x42566d
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._ssh_hash_reset_1
mov dword [ebp - 0x20], 0
jmp 0x4256d8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
add eax, edx
movzx eax, byte [eax]
xor eax, 0x36
movzx edx, al
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._BinarySink_put_byte
add dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jb 0x4256ae
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
jmp 0x425705
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
mov dword [esp + 4], 0x36
mov dword [esp], eax
call sym._BinarySink_put_byte
add dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
cmp dword [ebp - 0x24], eax
jb 0x4256e8
cmp dword [ebp - 0x14], 0
je 0x425723
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strbuf_free
nop
leave
ret
Function at 0x4321b7
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
sub eax, 0x7c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x468380
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov dword [esp], eax
call sym._sha256_block_setup
nop
leave
ret