joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427925
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x40
pop edi
push edi
lea eax, [ebp - 0x40]
push 0x36
push eax
call fcn.0044ce90
xor ecx, ecx
add esp, 0xc
cmp dword [ebp + 0x10], ecx
jle 0x427962
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x427962
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, dword [ebp + 0x10]
jl 0x42794f
mov ebx, dword [ebp + 8]
push ebx
call fcn.0042772c
push edi
lea eax, [ebp - 0x40]
push eax
push ebx
call fcn.00427757
push edi
lea eax, [ebp - 0x40]
push 0x5c
push eax
call fcn.0044ce90
xor ecx, ecx
add esp, 0x1c
cmp dword [ebp + 0x10], ecx
jle 0x4279a7
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x4279a7
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, dword [ebp + 0x10]
jl 0x427994
lea edx, [ebx + 0x5c]
push edx
call fcn.0042772c
push edi
lea eax, [ebp - 0x40]
push eax
push edx
call fcn.00427757
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.00446471
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42815d
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor ecx, ecx
or edi, 0xffffffff
mov eax, dword [ebp + 8]
mov al, byte [ecx + eax]
cmp al, 0x41
jl 0x428180
cmp al, 0x5a
jg 0x428180
movsx eax, al
sub eax, 0x41
jmp 0x4281b7
cmp al, 0x61
jl 0x428190
cmp al, 0x7a
jg 0x428190
movsx eax, al
sub eax, 0x47
jmp 0x4281b7
cmp al, 0x30
jl 0x4281a0
cmp al, 0x39
jg 0x4281a0
movsx eax, al
add eax, 4
jmp 0x4281b7
cmp al, 0x2b
jne 0x4281a9
push 0x3e
pop eax
jmp 0x4281b7
cmp al, 0x2f
jne 0x4281b1
push 0x3f
jmp 0x4281a6
cmp al, 0x3d
jne 0x4281db
mov eax, edi
mov dword [ebp + ecx*4 - 0x10], eax
inc ecx
cmp ecx, 4
jl 0x42816a
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
je 0x4281db
cmp dword [ebp - 0xc], edi
je 0x4281db
mov esi, dword [ebp - 8]
cmp esi, edi
mov edx, dword [ebp - 4]
jne 0x4281e1
cmp edx, edi
je 0x4281ee
xor eax, eax
pop edi
pop esi
leave
ret
xor eax, eax
cmp edx, edi
setne al
inc eax
inc eax
mov edi, eax
jmp 0x4281f1
xor edi, edi
inc edi
shl ecx, 6
or ecx, dword [ebp - 0xc]
and esi, 0x3f
shl ecx, 6
or ecx, esi
and edx, 0x3f
shl ecx, 6
or ecx, edx
mov edx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 0x10
cmp edi, 1
mov byte [edx], al
jle 0x42821e
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
cmp edi, 2
jle 0x428226
mov byte [edx + 2], cl
mov eax, edi
jmp 0x4281dd

Function at 0x42918e
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push 1
mov esi, 0x258
push esi
call fcn.0040b3b0
mov edi, eax
call fcn.00428fa0
mov eax, dword [0x474988]
push esi
lea eax, [eax + 0x4744d8]
push eax
push edi
call fcn.0044c930
mov eax, dword [esp + 0x24]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
add esp, 0x14
mov dword [eax], edi
pop edi
pop esi
jmp fcn.00428fa0
Function at 0x42a648
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 0xc], eax
jle 0x42a6f8
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
mov dword [ebp - 8], eax
jg 0x42a66e
mov dword [ebp - 8], ecx
cmp eax, 0x20
jle 0x42a68a
push 0x3d4
push str..._sshrsa.c
push str.h__hlen___SSH2_KEX_MAX_HASH_LEN
call fcn.0044c558
add esp, 0xc
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 4], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 3], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 2], al
mov byte [ebp - 1], bl
call dword [esi]
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
push edi
call dword [esi + 4]
push 4
lea eax, [ebp - 4]
push eax
push edi
call dword [esi + 4]
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [esi + 8]
mov eax, dword [ebp - 8]
add esp, 0x20
inc ebx
test eax, eax
jle 0x42a6e7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edi, [ebp - 0x2c]
sub edi, eax
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x42a6db
mov eax, dword [ebp - 8]
sub dword [ebp + 0x10], eax
add dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], 0
jg 0x42a65e
pop edi
pop ebx
leave
ret

Function at 0x42a959
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x42b13d
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x40
pop edi
push edi
lea eax, [ebp - 0x40]
push 0x36
push eax
call fcn.0044ce90
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jle 0x42b177
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x42b177
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x42b165
push dword [ebp + 8]
call fcn.0042af3f
push edi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
call fcn.0042af58
push edi
lea eax, [ebp - 0x40]
push 0x5c
push eax
call fcn.0044ce90
add esp, 0x1c
xor ecx, ecx
test ebx, ebx
jle 0x42b1bb
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x42b1bb
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x42b1a9
mov edx, dword [ebp + 8]
add edx, 0x6c
push edx
call fcn.0042af3f
push edi
lea eax, [ebp - 0x40]
push eax
push edx
call fcn.0042af58
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.00446471
add esp, 0x18
pop edi
pop esi
leave
ret
Function at 0x42c9f7
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x58], ecx
ret

Function at 0x42cc3d
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x40
pop edi
push edi
lea eax, [ebp - 0x40]
push 0x36
push eax
call fcn.0044ce90
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jle 0x42cc77
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x42cc77
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x42cc65
push dword [ebp + 8]
call fcn.0042c9f7
push edi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
call fcn.0042ca29
push edi
lea eax, [ebp - 0x40]
push 0x5c
push eax
call fcn.0044ce90
add esp, 0x1c
xor ecx, ecx
test ebx, ebx
jle 0x42ccbb
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
sub esi, eax
cmp ecx, edi
jge 0x42ccbb
lea eax, [ebp + ecx - 0x40]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jl 0x42cca9
mov edx, dword [ebp + 8]
add edx, 0x60
push edx
call fcn.0042c9f7
push edi
lea eax, [ebp - 0x40]
push eax
push edx
call fcn.0042ca29
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.00446471
add esp, 0x18
pop edi
pop esi
leave
ret
Function at 0x43ceae
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0
push 0x43c7f4
push 0
push 0x6f
push dword [0x477518]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
pop esi
ret

Function at 0x43daf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0040b6cc
push dword [0x4574d8]
mov esi, eax
lea eax, [ebp - 0x64]
push str._.70s_Command_Line_Error
push eax
call fcn.0044cd68
add esp, 0x14
push 0x10
lea eax, [ebp - 0x64]
push eax
push esi
push dword [0x4774fc]
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0040b470
pop ecx
push 1
call fcn.0044ef2f
int3

Function at 0x43f872
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
lea eax, [edi + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
je 0x43f917
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, ebx
je 0x43f916
push edi
push dword [esp + 0x1c]
push esi
call fcn.0044c930
add esp, 0xc
push ebp
mov byte [esi + edi], bl
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [esp + 0x20], ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, 0x8002
jne 0x43f8d7
push ebx
push 1
push edi
push dword [0x4774fc]
call esi
push dword [0x4774fc]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43f8fe
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebp
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x43f905
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x20], ebx
jne 0x43f916
push ebx
push ebx
push edi
push dword [0x4774fc]
call esi
pop esi
pop edi
pop ebp
pop ebx
ret
Function at 0x44018c
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push dword [0x4774fc]
push 0x440064
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret

Function at 0x440339
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
cmp dword [ebp + 0xc], 1
push esi
jne 0x440376
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x476164]
js 0x440362
cmp eax, 0x32
jl 0x440453
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
call esi
mov dword [0x476164], eax
jmp 0x44043d
cmp dword [ebp + 0xc], 3
jne 0x4403fb
push 0x67
push dword [0x4774dc]
call fcn.0040238d
pop ecx
pop ecx
push 0x20001
mov esi, eax
push 0
push dword [esi]
call dword [sym.imp.WINMM.dll_PlaySoundA]
test eax, eax
jne 0x44043d
push dword [esi]
lea eax, [ebp - 0x54]
push str.Unable_to_play_sound_file_n_s_nUsing_default_sound_instead
push eax
call fcn.0044cd68
push dword [0x4574d8]
lea eax, [ebp - 0xb8]
push str._.70s_Sound_Error
push eax
call fcn.0044cd68
add esp, 0x18
push 0x30
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [0x4774fc]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
push 0x61
push dword [0x4774dc]
call fcn.0040248b
add esp, 0xc
jmp 0x44043d
cmp dword [ebp + 0xc], 4
jne 0x44043d
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x476168]
js 0x440416
cmp eax, 0x32
jl 0x440453
cmp dword [0x477450], 2
jne 0x44042e
push 0x64
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x440436
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
call esi
mov dword [0x476168], eax
mov eax, dword [0x4774f0]
cmp dword [eax + 0x134], 0
jne 0x440453
push 2
call fcn.0044026a
pop ecx
pop esi
leave
ret

Function at 0x4407de
Capabilities:
Terminate process

Disassembly:
call fcn.0043e4c7
push dword [0x474dc8]
call fcn.0040b470
mov eax, dword [0x475c74]
test eax, eax
pop ecx
je 0x4407ff
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.00446dd1
push 2
push dword [0x4774dc]
call fcn.00402036
cmp eax, 3
pop ecx
pop ecx
jne 0x44081d
call fcn.0044855e
call fcn.0044b432
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [esp + 4]
call fcn.0044ef2f
int3
Function at 0x44122e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push 2
push dword [0x4774dc]
call fcn.00402036
push eax
call fcn.0040e75f
xor ebx, ebx
add esp, 0xc
cmp eax, ebx
mov dword [0x475104], eax
jne 0x44128b
push dword [0x4574d8]
push str._s_Internal_Error
call fcn.0040b852
pop ecx
pop ecx
push 0x30
mov esi, eax
push esi
push str.Unsupported_protocol_number_found
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0040b470
pop ecx
push 1
call fcn.004407de
push edi
push 8
push dword [0x4774dc]
call fcn.00402036
pop ecx
pop ecx
push eax
push 7
push dword [0x4774dc]
call fcn.00402036
pop ecx
pop ecx
push eax
lea eax, [ebp - 4]
push eax
push 1
push dword [0x4774dc]
call fcn.00402036
pop ecx
pop ecx
push eax
push ebx
push dword [0x4774dc]
call fcn.0040213a
pop ecx
pop ecx
push eax
push dword [0x4774dc]
mov eax, dword [0x475104]
push 0x474dd4
push ebx
call dword [eax]
push dword [0x4774e4]
mov edi, eax
push dword [0x474dd4]
mov eax, dword [0x475104]
call dword [eax + 0x34]
add esp, 0x28
cmp edi, ebx
je 0x441353
push dword [0x4574d8]
push str._s_Error
call fcn.0040b852
pop ecx
pop ecx
push edi
push dword [0x4774dc]
mov esi, eax
call fcn.0040b4aa
pop ecx
push eax
lea eax, [ebp - 0x404]
push str.Unable_to_open_connection_to_n_.800s_n_s
push eax
call fcn.0044cd68
add esp, 0x10
push 0x10
push esi
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0040b470
pop ecx
push ebx
call fcn.0044ef2f
push 0x5a
push dword [0x4774dc]
mov dword [0x475c3c], ebx
mov dword [0x475c7c], ebx
call fcn.0040213a
pop ecx
mov esi, eax
cmp byte [esi], bl
pop ecx
pop edi
jne 0x441398
push dword [0x4574d8]
lea eax, [ebp - 0x404]
push dword [ebp - 4]
push str._s____s
push eax
call fcn.0044cd68
add esp, 0x10
lea esi, [ebp - 0x404]
push dword [ebp - 4]
call fcn.0040b470
push esi
push ebx
call fcn.0043f5af
push esi
push ebx
call fcn.0043f60f
push dword [0x474dd4]
mov eax, dword [0x475104]
push dword [eax + 0x14]
push dword [0x4774f0]
call fcn.004305d4
push ebx
push dword [0x474dd4]
push dword [0x475104]
push dword [0x4774f0]
push dword [0x4774dc]
call fcn.00408a6b
add esp, 0x34
mov dword [0x475118], eax
xor esi, esi
push ebx
push 0x40
push dword [esi + 0x474dcc]
call dword [sym.imp.USER32.dll_DeleteMenu]
add esi, 4
cmp esi, 8
jb 0x4413ef
pop esi
mov dword [0x474db8], ebx
mov dword [0x475c68], ebx
pop ebx
leave
ret
Function at 0x445710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x1034
push 1
call fcn.0040b3b0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
pop ecx
pop ecx
xor edi, edi
push edi
push edi
mov esi, eax
mov eax, dword [ebp + 8]
push edi
push edi
mov dword [esi], edi
mov dword [esi + 4], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 8], eax
call ebx
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1030], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [0x47618c]
cmp eax, edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
jne 0x445780
push 0x4117bf
call fcn.00437698
pop ecx
mov dword [0x47618c], eax
push esi
push eax
call fcn.00437c0c
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push edi
lea eax, [esi + 4]
push eax
push 0x44544c
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 0x1c], 1
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4457ad
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0x1034
inc edi
push edi
call fcn.0040b3b0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
pop ecx
mov esi, eax
mov eax, dword [ebp + 8]
pop ecx
mov dword [esi], edi
xor edi, edi
push edi
push edi
push edi
push edi
mov dword [esi + 4], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 8], eax
call ebx
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x38]
push eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.0040b2ff
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [0x47618c]
cmp eax, edi
pop ecx
mov dword [esi + 0x44], edi
jne 0x44582c
push 0x4117bf
call fcn.00437698
pop ecx
mov dword [0x47618c], eax
push esi
push eax
call fcn.00437c0c
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push edi
lea eax, [esi + 4]
push eax
push 0x4455ac
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4464b2
Capabilities:
Get common file path

Disassembly:
cmp dword [0x4769b0], 0
push esi
push edi
jne 0x4464f0
xor esi, esi
lea eax, [esi + esi*2]
cdq
sub eax, edx
sar eax, 1
add eax, 0x200
mov esi, eax
push 1
push esi
push dword [0x4769b0]
call fcn.0040b40a
add esp, 0xc
push esi
push eax
mov dword [0x4769b0], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
jge 0x4464bf
push 0
push dword [esp + 0x10]
push 0x46c9e0
push dword [0x4769b0]
call fcn.0040b651
add esp, 0x10
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov edi, eax
call fcn.0040b470
pop ecx
mov eax, edi
pop edi
pop esi
ret
Function at 0x4486f8
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
push edi
push 0x107
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x130]
push 0x46d484
push eax
call fcn.0044df00
pop ecx
pop ecx
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [ebp + 8]
mov esi, eax
cmp esi, 0xffffffff
je 0x448770
lea eax, [ebp - 0x270]
push 0x140
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x448747
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
call ebx
xor edi, edi
cmp dword [0x47709c], edi
pop ecx
pop ecx
jne 0x448801
push str.advapi32.dll
call fcn.004464b2
cmp eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ecx
mov dword [0x47709c], eax
je 0x4487bb
push str.CryptAcquireContextA
push eax
call esi
mov dword [0x477094], eax
mov eax, dword [0x47709c]
jmp 0x4487c1
mov dword [0x477094], edi
cmp eax, edi
je 0x4487d9
push str.CryptGenRandom
push eax
call esi
mov dword [0x477090], eax
mov eax, dword [0x47709c]
jmp 0x4487df
mov dword [0x477090], edi
cmp eax, edi
je 0x4487f7
push str.CryptReleaseContext
push eax
call esi
mov dword [0x477098], eax
mov eax, dword [0x47709c]
jmp 0x4487fd
mov dword [0x477098], edi
cmp eax, edi
je 0x448854
mov eax, dword [0x477094]
cmp eax, edi
je 0x448854
cmp dword [0x477090], edi
je 0x448854
cmp dword [0x477098], edi
je 0x448854
push 0xf0000000
push 1
push edi
push edi
lea ecx, [ebp - 4]
push ecx
call eax
test eax, eax
je 0x448854
lea eax, [ebp - 0x28]
push eax
push 0x20
push dword [ebp - 4]
call dword [0x477090]
test eax, eax
je 0x44884a
lea eax, [ebp - 0x28]
push 0x20
push eax
call ebx
pop ecx
pop ecx
push edi
push dword [ebp - 4]
call dword [0x477098]
push ebx
call fcn.0044a0a5
pop ecx
call fcn.0044855e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448ef1
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push 0xd
push dword [ebp + 0x28]
call fcn.00402036
cmp eax, 5
pop ecx
pop ecx
je 0x448f0c
xor eax, eax
leave
ret
push ebx
push esi
push edi
push dword [ebp + 0x28]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040d2c1
push eax
push str.Starting_local_proxy_command:__s
mov dword [ebp - 4], eax
call fcn.0040b852
mov esi, eax
push esi
xor edi, edi
push edi
call fcn.0043d0e9
push esi
call fcn.0040b470
xor ebx, ebx
push 0x20
inc ebx
push ebx
call fcn.0040b3b0
mov esi, eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x18], eax
add esp, 0x28
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
mov dword [esi], 0x46d538
mov dword [esi + 0x14], edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreatePipe]
push eax
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x1c], edi
call ebx
test eax, eax
je 0x448fa4
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call ebx
test eax, eax
jne 0x448fc0
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0xc]
call edi
push str.Unable_to_create_pipes_for_proxy_command
call fcn.0040b852
push dword [ebp - 4]
mov dword [esi + 0x14], eax
call fcn.0040b470
pop ecx
pop ecx
jmp 0x44907e
mov ebx, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push edi
push 1
push dword [ebp - 0x14]
call ebx
push edi
push 1
push dword [ebp - 8]
call ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
push edi
push edi
push 0x8000020
push 1
push edi
push edi
push dword [ebp - 4]
mov dword [ebp - 0x74], 0x44
push edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], 0x100
mov word [ebp - 0x42], di
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x34], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x2c]
call ebx
push dword [ebp - 4]
call fcn.0040b470
pop ecx
push dword [ebp - 0x10]
call ebx
push dword [ebp - 0xc]
call ebx
mov eax, dword [ebp - 0x14]
push edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
push esi
mov dword [esi + 8], eax
push 0x448e0f
push dword [ebp - 8]
call fcn.00445710
push edi
push esi
push 0x448e4b
push dword [esi + 4]
mov dword [esi + 0x10], eax
call fcn.004457ad
push dword [ebp + 8]
mov dword [esi + 0xc], eax
call fcn.004477f5
add esp, 0x24
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x449a1f
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x46d80c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x449a83
push esi
push 1
push dword [ebp + 8]
call fcn.0044c220
pop ecx
lea eax, [eax + eax*2 + 1]
push eax
call fcn.0040b3b0
pop ecx
mov esi, eax
pop ecx
mov ecx, dword [ebp + 8]
mov edx, esi
call fcn.0044957a
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push esi
call fcn.0040b470
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
call fcn.00446368
pop ecx
pop esi
leave
ret
Function at 0x449d8c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 1
push dword [ebp + 8]
call fcn.0044c220
push dword [ebp + 0x10]
mov esi, eax
call fcn.0044c220
pop ecx
lea eax, [esi + eax + 5]
pop ecx
lea eax, [eax + eax*2]
push eax
call fcn.0040b3b0
push dword [ebp + 0x10]
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00449b27
add esp, 0x14
lea eax, [ebp - 4]
push eax
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x449e04
push dword [ebp + 0x14]
call fcn.0044c220
pop ecx
inc eax
push eax
push dword [ebp + 0x14]
push 1
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0040b470
pop ecx
pop esi
leave
ret

Function at 0x449e0e
Capabilities:
Check if file exists
Delete file

Disassembly:
test ecx, ecx
jne 0x449e4f
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x449e49
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x449e48
call edi
push eax
call fcn.00446525
push eax
push dword [esp + 0x10]
push str.Unable_to_delete__s:__s
call fcn.004401c6
add esp, 0x10
pop edi
or dword [esi], 0xffffffff
xor eax, eax
ret
push 2
pop eax
cmp ecx, eax
jne 0x449e5d
mov edx, 0x80
jmp 0x449e5f
xor edx, edx
push 0
push edx
xor edx, edx
cmp ecx, eax
setne dl
add edx, eax
push edx
mov edx, ecx
sub edx, eax
neg edx
sbb edx, edx
and edx, 3
push 0
push edx
xor edx, edx
cmp ecx, eax
setne dl
dec edx
and edx, 0xc0000000
add edx, 0x80000000
push edx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi], eax
mov eax, ecx
ret