joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408294
Capabilities:
Gather southriver-webdrive information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4084a8
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x4082e9
jmp 0x4084a0
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
lea eax, [ebp - 0x820]
push eax
push str.PassWord
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push 0x4175e4
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push 0x4175e8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x818], eax
push 0
push str.RootDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x824], eax
push 0
push 0x4175ff
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x828], eax
push 0
push 0x41763b
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x40843a
cmp dword [ebp - 0x814], 0
je 0x40843a
cmp dword [ebp - 0x818], 0
je 0x40843a
push 0xbeef0010
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x820]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015dd
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x82c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x824]
call fcn.004018f6
push dword [ebp - 0x828]
call fcn.004018f6
push dword [ebp - 0x82c]
call fcn.004018f6
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408294
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x4082bb
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408ce9
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je 0x408d08
cmp byte [eax], 0
jne 0x408d0d
jmp 0x408e5e
push dword [ebp + 0xc]
call fcn.004025f8
and eax, eax
jne 0x408d28
push str..
push dword [ebp + 0xc]
call fcn.00401e36
jmp 0x408d35
push 0x4168e3
push dword [ebp + 0xc]
call fcn.00401e36
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x140]
push eax
call fcn.00401924
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x408e5e
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je 0x408df6
lea eax, [edx + 0x2c]
push eax
push 0x4168d9
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x408d90
jmp 0x408e39
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4168db
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x408dad
jmp 0x408e39
push dword [ebp + 0xc]
call fcn.004025f8
and eax, eax
jne 0x408dc8
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
jmp 0x408dd2
push 0
push dword [ebp + 0xc]
call fcn.00401e36
lea edx, [ebp - 0x140]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e8a
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00408ce9
call fcn.004018f6
jmp 0x408e39
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x408e39
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push dword [ebp - 0x14c]
push eax
call fcn.00401e8a
push eax
push eax
push dword [ebp + 8]
call fcn.00408ca4
call fcn.004018f6
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x408d6b
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018f6
leave
ret 0xc
Function at 0x408e6d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je 0x408e8c
cmp byte [eax], 0
jne 0x408e91
jmp 0x408f9a
push str..
push dword [ebp + 0xc]
call fcn.00401e36
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x140]
push eax
call fcn.00401924
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x408f9a
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je 0x408f75
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4168d9
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x408f00
jmp 0x408f75
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4168db
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x408f1a
jmp 0x408f75
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push dword [ebp - 0x14c]
push eax
call fcn.00401e8a
mov dword [ebp - 0x150], eax
push eax
push str.opera
push dword [ebp - 0x150]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x408f70
push str.wand.dat
push dword [ebp - 0x150]
push dword [ebp + 8]
call fcn.00408ce9
call fcn.004018f6
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x408ed4
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018f6
leave
ret 8

Function at 0x4090b8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4091a3
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40910d
jmp 0x40919b
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push 0x41772b
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40916c
push 0xbeef0001
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004044cf
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004090b8
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x4090df
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x4091a7
Capabilities:
Gather wise-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4092e5
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x4091fc
jmp 0x4092dd
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push dword [ebp - 0x814]
call fcn.0040246b
and eax, eax
je 0x4092ae
push eax
mov dword [ebp - 0x818], eax
push dword [ebp - 0x818]
call fcn.00401fbd
and eax, eax
je 0x4092a9
push 0xbeef0002
push str.wiseftpsrvs.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004047dd
push 0xbeef0002
push str.wiseftp.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004047dd
push 0xbeef0000
push str.wiseftpsrvs.bin
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004047dd
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004091a7
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x4091ce
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x409425
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dword [0x4178db], 0
sub ebx, ebx
push dword [ebp + 8]
call sub.KERNEL32.DLL_lstrlenA
mov edx, dword [ebp + 8]
cmp eax, 2
jbe 0x409456
add edx, eax
sub edx, 2
cmp word [edx], 0x5c5c
jne 0x409456
mov word [edx], 0x5c
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_SetCurrentDirectoryA
push 0x4178b7
push str.nss3.dll
call fcn.00402516
and eax, eax
je 0x4094d6
push dword [ebp + 8]
call dword [0x4178b7]
add esp, 4
and eax, eax
jne 0x4094d6
call dword [0x4178c7]
mov dword [0x4178db], eax
cmp dword [0x4178db], 0
jne 0x40949d
call dword [0x4178bb]
jmp 0x4094d6
push 0
push 1
push dword [0x4178db]
call dword [0x4178cb]
add esp, 0xc
and eax, eax
je 0x4094d5
push dword [0x4178db]
call dword [0x4178d3]
add esp, 4
call dword [0x4178bb]
mov dword [0x4178db], 0
jmp 0x4094d6
inc ebx
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x409cd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push dword [ebp + 0xc]
call fcn.00401fbd
and eax, eax
jne 0x409ce8
pop edi
leave
ret 0xc
push dword [ebp + 0x10]
call fcn.00401fbd
and eax, eax
jne 0x409cf9
pop edi
leave
ret 0xc
push dword [ebp + 0xc]
call fcn.004025f8
and eax, eax
jne 0x409d14
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
jmp 0x409d1e
push 0
push dword [ebp + 0xc]
call fcn.00401e36
mov dword [ebp - 0xc], eax
push str.profiles.ini
push dword [ebp - 0xc]
call fcn.00401e36
mov dword [ebp - 8], eax
push 0xfdea
call fcn.0040190d
mov dword [ebp - 4], eax
push 0x1000
call fcn.0040190d
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
call fcn.00401f74
and eax, eax
je 0x409e18
push dword [ebp - 8]
push 0xfde8
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetPrivateProfileSectionNamesA
cmp eax, 2
jbe 0x409e18
mov edi, dword [ebp - 4]
cmp byte [edi], 0
je 0x409e18
push str.Profile
push edi
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x409e06
push dword [ebp - 8]
push 0xfff
push dword [ebp - 0x10]
push 0x416143
push 0x4178ff
push edi
call sub.KERNEL32.DLL_GetPrivateProfileStringA
and eax, eax
je 0x409e06
push dword [ebp - 8]
push 1
push str.IsRelative
push edi
call sub.KERNEL32.DLL_GetPrivateProfileIntA
cmp eax, 1
jne 0x409df8
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00401e36
push eax
mov edx, eax
jmp 0x409ddc
cmp byte [edx], 0x2f
jne 0x409ddb
mov byte [edx], 0x5c
inc edx
and edx, edx
je 0x409de5
cmp byte [edx], 0
jne 0x409dd3
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00409cb8
call fcn.004018f6
jmp 0x409e06
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.00409cb8
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x409d80
push dword [ebp - 0xc]
call fcn.004018f6
push dword [ebp - 0x10]
call fcn.004018f6
push dword [ebp - 8]
call fcn.004018f6
push dword [ebp - 4]
call fcn.004018f6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409cb8
pop edi
leave
ret 0xc
Function at 0x409e4b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x409eb7
push 0
push str.PathToExe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401daf
and eax, eax
je 0x409eb7
push eax
push eax
call fcn.0040246b
and eax, eax
je 0x409eb2
mov dword [ebp - 0x18], eax
push 0x1a
call fcn.00401eef
and eax, eax
je 0x409eaa
push dword [ebp + 0x18]
push eax
call fcn.00401e8a
push eax
push dword [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00409cd0
call fcn.004018f6
push dword [ebp - 0x18]
call fcn.004018f6
call fcn.004018f6
push 0x800
call fcn.0040190d
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x409f47
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x409f05
jmp 0x409f3f
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
push dword [ebp - 8]
push eax
call fcn.00401e8a
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409e4b
push dword [ebp - 0x14]
call fcn.004018f6
inc dword [ebp - 0x10]
jmp 0x409ede
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 8]
call fcn.004018f6
leave
ret 0x14

Function at 0x40b1fc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40b333
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40b254
jmp 0x40b32b
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x818], eax
call fcn.004018f6
lea eax, [ebp - 0x10]
push eax
push str.SiteServers
push dword [ebp - 0x818]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40b2ff
cmp dword [ebp - 0x10], 4
jne 0x40b2f4
mov eax, dword [ebp - 0x814]
push dword [eax]
pop dword [ebp - 0x814]
cmp dword [ebp - 0x814], 0x3e8
jbe 0x40b2cf
mov dword [ebp - 0x814], 0x3e8
jmp 0x40b2eb
dec dword [ebp - 0x814]
push dword [ebp - 0x814]
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040af63
cmp dword [ebp - 0x814], 0
jne 0x40b2d1
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040b1fc
push dword [ebp - 0x818]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40b226
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40d7c8
Capabilities:
Gather robo-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40da1d
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40d81d
jmp 0x40da15
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x814], eax
call fcn.004018f6
lea eax, [ebp - 0xc]
push eax
push 0x4180c7
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x828], eax
push 0
push str.ServerName
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x818], eax
push 0
push 0x4180db
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x82c]
push eax
push 0x4180f3
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401daf
and eax, eax
je 0x40d8cf
cmp dword [ebp - 0x82c], 4
jne 0x40d8cf
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004018f6
jmp 0x40d8e3
and eax, eax
je 0x40d8d9
push eax
call fcn.004018f6
mov dword [ebp - 0x820], 0x15
push 0
push str.InitialDirectory
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x824], eax
push 0
push str.ServerType
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x828], 0
je 0x40d9ba
push 0x418109
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x828]
call fcn.00404868
and eax, eax
je 0x40d9ba
cmp dword [ebp - 0xc], 0
je 0x40d9ba
cmp dword [ebp - 0x81c], 0
je 0x40d9ba
cmp dword [ebp - 0x818], 0
je 0x40d9ba
push 0xbeef0010
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0xc]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.004015dd
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x830]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x828]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x824]
call fcn.004018f6
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x830]
call fcn.004018f6
push dword [ebp - 0x814]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d7c8
push dword [ebp - 0x814]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40d7ef
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40da21
Capabilities:
Gather robo-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push str.FTP_Count
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401daf
and eax, eax
je 0x40daac
push eax
cmp dword [ebp - 4], 4
jne 0x40daa7
push dword [eax]
pop dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jbe 0x40da5d
mov dword [ebp - 8], 0x1f4
jmp 0x40daa1
push dword [ebp - 8]
push str.FTP_File_d
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401daf
and eax, eax
je 0x40da9e
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.004044f8
call fcn.004018f6
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x40da5f
call fcn.004018f6
leave
ret 8

Function at 0x40dd16
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40dee8
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40dd6e
jmp 0x40dee0
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x824], eax
call fcn.004018f6
push 0
push str.Host
push dword [ebp - 0x824]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x810], eax
push 0
push str.User
push dword [ebp - 0x824]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push str.Pass
push dword [ebp - 0x824]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x818], eax
push 0
push 0x418169
push dword [ebp - 0x824]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push str.Remote_Dir
push dword [ebp - 0x824]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x814], 0
je 0x40de88
push 0xbeef0000
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.0040dd16
push dword [ebp - 0x824]
call fcn.004018f6
push dword [ebp - 0x810]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x820]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40dd40
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40e150
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40e330
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40e1a5
jmp 0x40e328
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x828], eax
call fcn.004018f6
push 0
push str.HostName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x810], eax
push 0
push str.UserName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push str.Password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.PortNumber
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push str.TerminalType
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401daf
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x810], 0
je 0x40e2cd
cmp dword [ebp - 0x814], 0
je 0x40e2cd
cmp dword [ebp - 0x818], 0
je 0x40e2cd
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.004015a7
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.004015dd
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.00401609
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040e150
push dword [ebp - 0x828]
call fcn.004018f6
push dword [ebp - 0x810]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x820]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40e177
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc