joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b2a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov ecx, dword [0x459d70]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test ecx, ecx
je 0x43b2e1
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ebx, str.The_first__s_supported_by_the_server_is_n_s__which_is_below_the_configured_warning_threshold._n
mov dword [esp + 8], edx
add eax, 0x40
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
xor edx, edx
mov ebx, dword [ebp - 4]
mov eax, edx
leave
ret
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ecx, 0x4550c0
mov dword [esp + 4], ecx
add eax, 0x40
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
sub esp, 4
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_GetConsoleMode
mov eax, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp], ebx
or eax, 7
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetConsoleMode
sub esp, 8
lea eax, [ebp - 0x30]
xor edx, edx
mov dword [esp + 0xc], eax
mov eax, 0x1f
mov dword [esp + 8], eax
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_ReadFile
mov eax, dword [ebp - 0x2c]
sub esp, 0x14
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetConsoleMode
movzx eax, byte [ebp - 0x28]
sub esp, 8
cmp al, 0x79
sete dl
cmp al, 0x59
sete al
or eax, edx
test al, 1
mov edx, 1
jne 0x43b2da
mov eax, 0x4551a9
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x43b2d8
Function at 0x43b3c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov edx, dword [0x459d70]
test edx, edx
je 0x43b413
lea eax, [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, 0x104
mov dword [esp + 8], eax
mov eax, str.The_session_log_file___.s__already_exists._nLogging_will_not_be_enabled._n
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
xor edx, edx
mov ebx, dword [ebp - 4]
mov eax, edx
leave
ret
lea eax, [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, 0x104
mov dword [esp + 8], eax
mov eax, str.The_session_log_file___.s__already_exists._nYou_can_overwrite_it_with_a_new_session_log__nappend_your_session_log_to_the_end_of_it__nor_disable_session_logging_for_this_session._nEnter__y__to_wipe_the_file___n__to_append_to_it__nor_just_press_Return_to_disable_logging._nWipe_the_log_file___y_n__Return_cancels_logging_
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
sub esp, 4
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_GetConsoleMode
mov eax, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp], ebx
or eax, 7
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetConsoleMode
sub esp, 8
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], eax
mov eax, 0x1f
mov dword [esp + 8], eax
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_ReadFile
mov eax, dword [ebp - 0x2c]
sub esp, 0x14
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetConsoleMode
movzx ecx, byte [ebp - 0x28]
sub esp, 8
cmp cl, 0x79
sete dl
cmp cl, 0x59
sete al
or eax, edx
test al, 1
mov edx, 2
jne 0x43b40c
cmp cl, 0x6e
mov ebx, dword [ebp - 4]
sete dl
leave
cmp cl, 0x4e
sete al
or eax, edx
xor edx, edx
test al, 1
setne dl
mov eax, edx
ret

Function at 0x43b520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 1
mov ebp, esp
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], ecx
mov dword [esp], str.These_are_the_fingerprints_of_the_PuTTY_PGP_Master_Keys._They_can_nbe_used_to_establish_a_trust_path_from_this_executable_to_another_none._See_the_manual_for_more_information._n_Note:_these_fingerprints_have_nothing_to_do_with_SSH___n_nPuTTY_Master_Key__RSA___1024_bit:_n__8F_15_97_DA_25_30_AB_0D__88_D1_92_54_11_CF_0C_4C_nPuTTY_Master_Key__DSA___1024_bit:_n__313C_3E76_4B74_C2C5_F2AE__83A8_4F5E_6DF5_6A93_B34E_n
add eax, 0x20
mov dword [esp + 0xc], eax
mov eax, 0x193
mov dword [esp + 8], eax
call sub.msvcrt.dll_fwrite
leave
ret
Function at 0x43b590
Capabilities:
Write file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], ecx
lea ecx, [ebp - 4]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
leave
ret
Function at 0x43be30
Capabilities:
Create thread

Disassembly:
push ebp
mov edx, 0x1034
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [esp + 4], edx
mov dword [esp], 1
call fcn.00403a80
mov dword [eax], 0
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [ebx + 8], eax
sub esp, 0x10
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0xc]
sub esp, 0x10
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1030], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x24], eax
mov eax, dword [0x459d90]
test eax, eax
je 0x43bf21
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0043a2d0
mov dword [esp], 0
lea eax, [ebp - 8]
xor ecx, ecx
mov dword [esp + 0x14], eax
lea eax, [ebx + 4]
mov edx, 0x43b9f0
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateThread
mov dword [ebx + 0x1c], 1
mov eax, ebx
sub esp, 0x18
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], 0x43bdf0
call fcn.00439ba0
mov dword [0x459d90], eax
jmp 0x43bed5

Function at 0x43bf40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, 0x1034
mov dword [esp + 4], ebx
mov dword [esp], 1
call fcn.00403a80
mov dword [eax], 1
mov ebx, eax
mov eax, dword [ebp + 8]
xor ecx, ecx
xor edx, edx
mov dword [ebx + 4], eax
xor eax, eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [ebx + 8], eax
sub esp, 0x10
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
sub esp, 0x10
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x38]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [esp], eax
call fcn.00403980
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x24], eax
mov eax, dword [0x459d90]
test eax, eax
je 0x43c040
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0043a2d0
mov dword [esp], 0
lea eax, [ebp - 8]
xor ecx, ecx
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [ebx + 4]
mov dword [esp + 0xc], eax
mov eax, 0x43bc10
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], 0x43bdf0
call fcn.00439ba0
mov dword [0x459d90], eax
jmp 0x43bff4
Function at 0x43c5a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x459db0]
mov esi, dword [ebp + 8]
test eax, eax
je 0x43c631
mov eax, dword [0x459da0]
test eax, eax
je 0x43c615
mov ebx, dword [0x446390]
cmp ebx, 0xffffffff
je 0x43c5f5
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 8], eax
xor edx, edx
mov dword [esp + 0x10], edx
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_WriteFile
mov eax, dword [0x459da0]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov eax, dword [0x459da0]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], str.debug.log
mov ecx, 0x4556ec
mov dword [esp + 4], ecx
call sub.msvcrt.dll_fopen
mov dword [0x459da0], eax
jmp 0x43c5bd
call sub.KERNEL32.dll_AllocConsole
test eax, eax
je 0x43c5b4
mov dword [esp], 0xfffffff5
mov ebx, 1
mov dword [0x459db0], ebx
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x446390], eax
sub esp, 4
jmp 0x43c5b4
Function at 0x43ed20
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x158]
push ebx
sub esp, 0x27c
mov ebx, 0x107
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x268]
mov edi, dword [ebp + 8]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
sub esp, 8
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov word [eax + ebx], 0x2a5c
mov byte [eax + ebx + 2], 0
mov dword [esp], ebx
mov dword [esp + 4], esi
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
cmp eax, 0xffffffff
mov ebx, eax
je 0x43edac
nop
lea esi, [esi]
mov dword [esp], esi
mov ecx, 0x140
mov dword [esp + 4], ecx
call edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
jne 0x43ed80
mov dword [esp], ebx
call sub.KERNEL32.dll_FindClose
sub esp, 4
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [ebp - 0x26c], eax
mov edx, 4
lea eax, [ebp - 0x26c]
mov dword [esp + 4], edx
mov dword [esp], eax
call edi
mov dword [esp], edi
call fcn.00443210
call fcn.0043ecd0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x43ee40
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 4
push esi
mov esi, 4
push ebx
sub esp, 0x7c
lea ebx, [ebp - 0x5c]
call sub.USER32.dll_GetForegroundWindow
mov dword [ebp - 0x5c], eax
mov dword [esp + 4], edi
lea edi, [ebp - 0x48]
mov dword [esp], ebx
call fcn.00432050
call sub.USER32.dll_GetCapture
mov dword [ebp - 0x5c], eax
mov dword [esp + 4], esi
lea esi, [ebp - 0x50]
mov dword [esp], ebx
call fcn.00432050
call sub.USER32.dll_GetClipboardOwner
mov dword [ebp - 0x5c], eax
mov ecx, 4
mov dword [esp + 4], ecx
mov dword [esp], ebx
lea ebx, [ebp - 0x68]
call fcn.00432050
mov dword [esp], 0xbf
call sub.USER32.dll_GetQueueStatus
mov dword [ebp - 0x60], eax
mov edx, 4
sub esp, 4
mov dword [esp + 4], edx
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.00432050
mov dword [esp], ebx
call sub.USER32.dll_GetCursorPos
sub esp, 4
mov eax, 8
mov dword [esp], ebx
lea ebx, [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.00432050
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalMemoryStatus
sub esp, 4
mov eax, 0x20
mov dword [esp + 4], eax
mov dword [esp], ebx
lea ebx, [ebp - 0x58]
call fcn.00432050
call sub.KERNEL32.dll_GetCurrentThread
mov dword [esp], eax
lea edx, [ebp - 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call sub.KERNEL32.dll_GetThreadTimes
sub esp, 0x14
mov eax, 0x20
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00432050
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp], eax
lea edx, [ebp - 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call sub.KERNEL32.dll_GetProcessTimes
sub esp, 0x14
mov eax, 0x20
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00432050
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43f690
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
xor ebx, ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
test eax, eax
je 0x43f6b2
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 8], eax
xor edx, edx
mov ecx, 0x400
mov dword [esp + 0x18], edx
lea edx, [ebp - 8]
xor ebx, ebx
mov dword [esp + 0x10], edx
xor edx, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
mov dword [esp + 0x14], ebx
mov dword [esp], 0x1300
call sub.KERNEL32.dll_FormatMessageA
sub esp, 0x1c
mov eax, 0x4563f0
mov dword [esp + 4], eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcspn
mov edx, dword [ebp - 8]
mov dword [esp + 4], eax
mov dword [esp], str._.s
mov dword [esp + 8], edx
call fcn.00403e90
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.KERNEL32.dll_LocalFree
sub esp, 4
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x43f730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 4], esi
mov dword [esp + 4], ebx
mov dword [esp], 0x100
call fcn.00403a80
mov dword [esp + 4], eax
mov esi, eax
mov dword [esp], 0x100
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
cmp eax, 0x100
mov ebx, eax
jg 0x43f790
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
mov eax, esi
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], esi
mov ecx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call fcn.00403d50
mov dword [esp], ebx
mov esi, eax
mov dword [esp + 4], esi
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
mov eax, esi
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43f7d0
Capabilities:
Get file size

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x48
mov ecx, 0x80000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, 3
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov ebx, 1
mov dword [ebp - 4], edi
xor edi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
sub esp, 0x1c
xor eax, eax
cmp ebx, 0xffffffff
je 0x43f85f
mov dword [esp], 1
mov edx, 4
mov dword [esp + 4], edx
call fcn.00403a80
mov dword [eax], ebx
test esi, esi
mov edi, eax
je 0x43f855
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileSize
mov dword [esi + 4], eax
sub esp, 8
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0x14]
jne 0x43f870
mov eax, edi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], ebx
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetFileTime
mov eax, dword [ebp + 0x14]
sub esp, 0x10
test eax, eax
je 0x43f8c1
mov eax, 0x989680
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00444f30
mov edx, dword [ebp + 0x14]
add eax, 0x49ef6f00
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x43f85d
mov eax, 0x989680
mov edx, dword [ebp - 0x14]
xor esi, esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00444f30
mov edx, dword [ebp + 0x10]
add eax, 0x49ef6f00
mov dword [edx], eax
jmp 0x43f85d

Function at 0x43f900
Capabilities:
Read file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], eax
lea eax, [ebp - 4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
mov edx, 0xffffffff
je 0x43f93d
mov edx, dword [ebp - 4]
leave
mov eax, edx
ret
Function at 0x43f9f0
Capabilities:
Get file size

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x28
xor ecx, ecx
mov dword [ebp - 0xc], ebx
mov edx, 3
mov dword [esp + 0xc], eax
mov eax, 1
xor ebx, ebx
mov dword [esp + 8], eax
mov eax, 0x40000000
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x18], ebx
mov dword [ebp - 8], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
sub esp, 0x1c
xor eax, eax
cmp ebx, 0xffffffff
je 0x43fa77
mov dword [esp], 1
mov eax, 4
mov dword [esp + 4], eax
call fcn.00403a80
mov dword [eax], ebx
test edi, edi
mov esi, eax
je 0x43fa75
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileSize
mov dword [edi + 4], eax
sub esp, 8
mov eax, esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x43fa90
Capabilities:
Write file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], eax
lea eax, [ebp - 4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
mov edx, 0xffffffff
je 0x43facd
mov edx, dword [ebp - 4]
leave
mov eax, edx
ret

Function at 0x43fc40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
xor edx, edx
cmp eax, 0xffffffff
je 0x43fc66
and eax, 0x10
cmp eax, 1
sbb edx, edx
add edx, 2
leave
mov eax, edx
ret

Function at 0x43fe00
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x154
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
inc eax
mov edx, 1
je 0x43fe27
mov ebx, dword [ebp - 4]
mov eax, edx
leave
ret
mov dword [esp], ebx
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
xor edx, edx
cmp eax, 0xffffffff
je 0x43fe20
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
sub esp, 4
mov edx, 2
jmp 0x43fe20
Function at 0x440600
Capabilities:
Create thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
lea ebx, [ebp - 0x10]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
cmp dword [0x4463a0], 0xffffffff
sete dl
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
test edx, eax
jne 0x440651
mov eax, dword [0x45a840]
test eax, eax
jne 0x440663
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], eax
call fcn.00404060
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], 0
xor ecx, ecx
xor edx, edx
mov dword [esp + 0xc], ecx
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateEventA
mov dword [ebp - 0x10], eax
sub esp, 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov eax, 0x4405d0
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
test eax, eax
je 0x4406e8
jmp 0x4406d0
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.00440220
test eax, eax
jl 0x440720
je 0x4406d0
mov eax, dword [ebx + 4]
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], str.Unable_to_create_command_input_thread_n
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0x26
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
call fcn.0043b040
jmp 0x4406d0
mov dword [esp], str.ret___0
mov ebx, 0x2af
mov ecx, str..._windows_winsftp.c
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
call sub.msvcrt.dll__assert
nop
Function at 0x441f10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
xor eax, eax
test ebx, ebx
je 0x441f68
mov ecx, dword [ebx]
test ecx, ecx
jne 0x441f80
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x441f66
mov dword [esp + 4], esi
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
je 0x441f70
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebp - 0x14], 1
mov eax, dword [ebp + 0x10]
jne 0x441f66
jmp 0x441f68
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea eax, [eax + eax*2 + 1]
mov edx, 1
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00403a80
mov edx, eax
mov edi, eax
mov eax, esi
call fcn.004408b0
mov ebx, dword [ebx + 4]
jmp 0x441fc5
mov dword [esp + 4], edi
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x441fcd
mov ebx, dword [ebx + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x441fb0
jmp 0x441f66
mov edx, dword [ebp + 0x14]
mov eax, dword [ebx + 4]
mov dword [esp], edx
mov edx, dword [ebp + 0x10]
call fcn.00440950
mov eax, dword [ebx + 4]
jmp 0x441f68

Function at 0x441ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], 4
mov esi, dword [ebp + 0xc]
test edx, edx
je 0x44203e
mov eax, dword [edx]
test eax, eax
je 0x442045
mov ebx, dword [edx + 4]
mov eax, dword [ebx]
test eax, eax
je 0x44203b
lea esi, [esi]
mov dword [esp + 4], esi
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x44208b
mov ebx, dword [ebx + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x442020
mov eax, dword [ebp + 0x10]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x44203b
mov dword [esp + 4], esi
lea eax, [ebp - 0xc]
xor ebx, ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x44203b
cmp dword [ebp - 0xc], 4
jne 0x44203b
cmp dword [ebp - 0x14], 4
jne 0x44203b
mov eax, dword [ebp - 0x10]
jmp 0x44203e
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
jmp 0x44203e