joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4269e1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40c]
push eax
push 0x20019
xor esi, esi
push esi
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x426a22
mov ecx, str._s_:_Failed_to_find_Dreamweaver_stored_entries_in_registry__Error0x_.8x
jmp 0x426aba
push ebx
xor ecx, ecx
lea eax, [ebp - 0x408]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x404]
mov ebx, ecx
push eax
push ecx
jmp 0x426a79
lea eax, [ebp - 0x404]
push eax
push str.RecoverDreamweaver10Password
push str._s_:_Found_site_entry__s
call fcn.00449974
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.00426382
add esp, 0x14
inc esi
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push dword [ebp - 0x40c]
mov dword [ebp - 0x408], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x426a3c
push eax
push str.RecoverDreamweaver10Password
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, str._s_:_Found__d_Dreamweaver_10_stored_URLS
mov eax, esi
pop ebx
push eax
push str.RecoverDreamweaver10Password
push ecx
call fcn.00449974
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
call fcn.005fe955
leave
ret

Function at 0x426ad7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40c]
push eax
push 0x20019
xor esi, esi
push esi
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x426b18
mov ecx, str._s_:_Failed_to_find_Dreamweaver_stored_entries_in_registry__Error0x_.8x
jmp 0x426bb0
push ebx
xor ecx, ecx
lea eax, [ebp - 0x408]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x404]
mov ebx, ecx
push eax
push ecx
jmp 0x426b6f
lea eax, [ebp - 0x404]
push eax
push str.RecoverDreamweaver11Password
push str._s_:_Found_site_entry__s
call fcn.00449974
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.00426621
add esp, 0x14
inc esi
inc ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push dword [ebp - 0x40c]
mov dword [ebp - 0x408], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x426b32
push eax
push str.RecoverDreamweaver11Password
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, str._s_:_Found__d_Dreamweaver_stored_URLS
mov eax, esi
pop ebx
push eax
push str.RecoverDreamweaver11Password
push ecx
call fcn.00449974
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
call fcn.005fe955
leave
ret
Function at 0x4273b7
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d4
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3eb]
xor ebx, ebx
push 0x3e7
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.00626f50
push esi
push str.RecoverEiskaltDCPasswords
push str._n__s_Entered_____s_
call fcn.00449974
push esi
call fcn.00631510
add esp, 0x1c
cmp eax, 1
lea eax, [ebp - 0x3ec]
jbe 0x427485
push esi
mov esi, 0x3e8
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
add esp, 0x10
cmp byte [ebp + eax - 0x3ed], 0x5c
jne 0x427450
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
dec eax
pop ecx
cmp eax, esi
jae 0x4275de
mov byte [ebp + eax - 0x3ec], bl
push str.Favorites.xml
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x3ec]
push eax
call fcn.00449791
add esp, 0x10
test eax, eax
je 0x4275cd
lea eax, [ebp - 0x3ec]
push eax
jmp 0x4275c1
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [ebp - 0x3ec], bl
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov esi, 0x3e8
test eax, eax
js 0x4274ee
push str.EiskaltDCFavorites.xml
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x3ec]
push eax
push str.RecoverEiskaltDCPasswords
push str._n__s_Checking_in_appdata_location_____s_
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
call fcn.00449791
add esp, 0x1c
test eax, eax
je 0x4274ee
lea eax, [ebp - 0x3ec]
push eax
push 0x2df
call fcn.00424d47
pop ecx
pop ecx
lea eax, [ebp - 0x3ec]
mov byte [ebp - 0x3ec], bl
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x427558
push str.EiskaltDCSettingsFavorites.xml
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x3ec]
push eax
push str.RecoverEiskaltDCPasswords
push str._n__s_Checking_in_program_files_location_____s_
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
call fcn.00449791
add esp, 0x1c
test eax, eax
je 0x427558
lea eax, [ebp - 0x3ec]
push eax
push 0x2df
call fcn.00424d47
pop ecx
pop ecx
cmp dword [0x716864], ebx
je 0x4275cd
push 0x3e4
lea eax, [ebp - 0x7d0]
mov dword [ebp - 0x7d4], 0x5c3a43
push ebx
push eax
call fcn.00626f50
add esp, 0xc
lea eax, [ebp - 0x7d4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx eax, byte [ebp - 0x7d4]
push eax
push str._c:Program_FilesEiskaltDCSettingsFavorites.xml
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3ec]
push eax
call fcn.00449791
add esp, 0x14
test eax, eax
je 0x4275cd
lea ecx, [ebp - 0x3ec]
push ecx
push 0x2df
call fcn.00424d47
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3
Function at 0x4278cc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
pop ecx
push 0x3e0
xor ebx, ebx
lea eax, [ebp - 0x3e4]
mov esi, str.SoftwareEmurasoftEmftpConfig
lea edi, [ebp - 0x404]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00626f50
add esp, 0xc
lea eax, [ebp - 0xc0c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x404]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x427946
push eax
push str.RecoverEmFTPPassword
push str._s_:_Failed_to_open_EmFTPConfig_key__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x427a7e
lea eax, [ebp - 0x404]
push eax
push str.RecoverEmFTPPassword
push str._s_:_Enumerating_key_within__s
call fcn.00449974
add esp, 0xc
mov dword [ebp - 0xc08], 0x400
lea eax, [ebp - 0xc08]
mov edi, ebx
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0xc04]
push eax
push ebx
push dword [ebp - 0xc0c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x427a58
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x404]
push eax
push 0x66c218
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.00445d6d
lea eax, [ebp - 0x804]
push eax
push str.RecoverEmFTPPassword
push str._s_:__Checking_for_Final_site_key__s
call fcn.00449974
add esp, 0x20
lea eax, [ebp - 0xc10]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x804]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x427a14
push eax
lea eax, [ebp - 0x804]
push eax
push str.RecoverEmFTPPassword
push str._s_:_Failed_to_open__s_key__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x427a30
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0xc10]
call fcn.004275e4
pop ecx
pop ecx
push dword [ebp - 0xc10]
call esi
xor eax, eax
mov dword [ebp - 0xc08], 0x400
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xc08]
inc edi
push eax
lea eax, [ebp - 0xc04]
push eax
push edi
push dword [ebp - 0xc0c]
call ebx
test eax, eax
je 0x427997
push eax
push str.RecoverEmFTPPassword
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0xc0c]
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x427a8d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14cc
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3eb]
push edi
mov edi, 0x3e7
xor ebx, ebx
push edi
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.00626f50
push edi
lea eax, [ebp - 0xfa3]
mov byte [ebp - 0xfa4], bl
push ebx
push eax
call fcn.00626f50
push edi
lea eax, [ebp - 0x7d3]
mov byte [ebp - 0x7d4], bl
push ebx
push eax
call fcn.00626f50
push esi
call fcn.00631510
add esp, 0x28
cmp eax, 1
jae 0x427b54
lea eax, [ebp - 0xfa4]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x427b31
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverExpanDrivePasswords
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x427c82
lea eax, [ebp - 0xfa4]
mov esi, 0x3e8
push eax
push str._sExpanDrive
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00445d6d
add esp, 0x10
jmp 0x427b6a
push esi
mov esi, 0x3e8
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x3ec]
push eax
push str._n_Final_Expandrive_folder_is___s
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x7d4]
push esi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x7d4]
push esi
push eax
call fcn.00631246
add esp, 0x20
lea eax, [ebp - 0x14cc]
push eax
lea eax, [ebp - 0x7d4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x427b2a
test byte [ebp - 0x14cc], 0x10
jne 0x427c5b
lea eax, [ebp - 0x14a0]
push eax
lea eax, [ebp - 0xbbc]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0xbbc]
push eax
call fcn.00631510
inc eax
push eax
lea eax, [ebp - 0xbbc]
push eax
call fcn.00631711
lea eax, [ebp - 0xbbc]
push eax
push str.RecoverExpanDrivePasswords
push str._s___Found_file__s
call fcn.00449974
lea eax, [ebp - 0xbbc]
push str..favorites.js
push eax
call fcn.00627320
add esp, 0x2c
test eax, eax
je 0x427c5b
lea eax, [ebp - 0x14a0]
push eax
lea eax, [ebp - 0x3ec]
push eax
push 0x66c218
lea eax, [ebp - 0x138c]
push esi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x138c]
push eax
call fcn.00427c91
add esp, 0x18
mov ecx, dword [0x715f84]
test ecx, ecx
je 0x427c78
lea edx, [ebp - 0x14cc]
push edx
push edi
call ecx
cmp eax, 1
je 0x427bc3
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x42841f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x403]
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x3ff
push ebx
push 0
push eax
mov byte [ebp - 0x404], 0
call fcn.00626f50
push ebx
lea eax, [ebp - 0xc03]
mov byte [ebp - 0xc04], 0
push 0
push eax
call fcn.00626f50
push ebx
lea eax, [ebp - 0x803]
mov byte [ebp - 0x804], 0
push 0
push eax
call fcn.00626f50
push ebx
lea eax, [ebp - 0x1003]
mov byte [ebp - 0x1004], 0
push 0
push eax
call fcn.00626f50
push esi
push str.RecoverFFFTPPassfromRegistry
push str._s_Entered___Recovering_from_key__s
call fcn.00449974
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1008]
add esp, 0x3c
mov dword [ebp - 0x1008], 0x3e8
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0
push str.HostAdrs
push edi
call esi
lea eax, [ebp - 0x1008]
inc ebx
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x1008], ebx
push eax
lea eax, [ebp - 0x100c]
push eax
push 0
push str.UserName
push edi
call esi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push eax
push str.RecoverFFFTPPassfromRegistry
push str._s_Entered___Found_server___s___User_s
call fcn.00449974
add esp, 0x10
mov dword [ebp - 0x1008], ebx
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0
push str.Password
push edi
call esi
pop edi
pop esi
pop ebx
test eax, eax
jne 0x42859e
cmp dword [ebp - 0x1008], eax
jbe 0x42859e
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0xc04]
push eax
call fcn.00409fe4
pop ecx
pop ecx
test eax, eax
je 0x42859e
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x1004]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push eax
push ecx
push 0x13e
push 4
call fcn.00412c85
add esp, 0x20
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.005fe955
leave
ret
Function at 0x4285ad
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 7
pop ecx
push 0x3e4
xor ebx, ebx
lea eax, [ebp - 0x3e8]
mov esi, str.SoftwareSotaFFFTPOptions
lea edi, [ebp - 0x404]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00626f50
add esp, 0xc
lea eax, [ebp - 0xc0c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x404]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x428627
push eax
push str.RecoverFFFTPPassword
push str._s_:_Failed_to_open_FFFTP_key__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x42875f
lea eax, [ebp - 0x404]
push eax
push str.RecoverFFFTPPassword
push str._s_:_Enumerating_key_within__s
call fcn.00449974
add esp, 0xc
mov dword [ebp - 0xc08], 0x400
lea eax, [ebp - 0xc08]
mov edi, ebx
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0xc04]
push eax
push ebx
push dword [ebp - 0xc0c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428739
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x404]
push eax
push 0x66c218
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.00445d6d
lea eax, [ebp - 0x804]
push eax
push str.RecoverFFFTPPassword
push str._s_:__Checking_for_Final_site_key__s
call fcn.00449974
add esp, 0x20
lea eax, [ebp - 0xc10]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x804]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4286f5
push eax
lea eax, [ebp - 0x804]
push eax
push str.RecoverFFFTPPassword
push str._s_:_Failed_to_open__s_key__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x428711
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0xc10]
call fcn.0042841f
pop ecx
pop ecx
push dword [ebp - 0xc10]
call esi
xor eax, eax
mov dword [ebp - 0xc08], 0x400
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xc08]
inc edi
push eax
lea eax, [ebp - 0xc04]
push eax
push edi
push dword [ebp - 0xc0c]
call ebx
test eax, eax
je 0x428678
push eax
push str.RecoverFFFTPPassword
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0xc0c]
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x42adcb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x803]
push edi
mov edi, 0x3ff
xor ebx, ebx
push edi
push ebx
push eax
mov byte [ebp - 0x804], bl
call fcn.00626f50
push edi
lea eax, [ebp - 0xc03]
mov byte [ebp - 0xc04], bl
push ebx
push eax
call fcn.00626f50
push edi
lea eax, [ebp - 0x403]
mov byte [ebp - 0x404], bl
push ebx
push eax
call fcn.00626f50
push esi
mov edi, str.RecoverFlingFTPPassfromRegistry
push edi
push str._s_Entered___Recovering_from_key__s
call fcn.00449974
add esp, 0x30
lea eax, [ebp - 0xc0c]
push eax
push 0x20019
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42ae79
push eax
push esi
push edi
push str._s_:_Failed_to_open_location__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc04]
mov dword [ebp - 0xc08], 0x3e8
push eax
lea eax, [ebp - 0xc10]
push eax
push ebx
push str.FtpServer
push dword [ebp - 0xc0c]
call esi
lea eax, [ebp - 0xc08]
mov edi, 0x400
push eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0xc08], edi
push eax
lea eax, [ebp - 0xc10]
push eax
push ebx
push str.FtpUserName
push dword [ebp - 0xc0c]
call esi
lea eax, [ebp - 0xc08]
mov dword [ebp - 0xc08], edi
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc10]
push eax
push ebx
push str._FtpPassword
push dword [ebp - 0xc0c]
call esi
test eax, eax
je 0x42af30
lea eax, [ebp - 0xc08]
mov dword [ebp - 0xc08], edi
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc10]
push eax
push ebx
push str.FtpPassword
push dword [ebp - 0xc0c]
call esi
push dword [ebp - 0xc0c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc08], ebx
jbe 0x42ae68
push dword [ebp - 0xc08]
lea eax, [ebp - 0x404]
push eax
call fcn.004088bd
pop ecx
pop ecx
test eax, eax
je 0x42ae68
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x404]
push ecx
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0xc04]
push eax
push ecx
push 0x15a
push 4
call fcn.00412c85
xor eax, eax
add esp, 0x20
inc eax
jmp 0x42ae6a
Function at 0x42af99
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0c
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 9
pop ecx
mov esi, str.SoftwareNCH_SoftwareFlingAccounts
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
push 0x3db
xor ebx, ebx
lea eax, [ebp - 0x3df]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00626f50
add esp, 0xc
lea eax, [ebp - 0xc0c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x404]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42b01b
push eax
lea eax, [ebp - 0x404]
push eax
push str.RecoverFlingFTPPasswords
push str._s_:_Failed_to_open_key_location__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor eax, eax
jmp 0x42b0d0
lea eax, [ebp - 0x404]
push eax
push str.RecoverFlingFTPPasswords
push str._s_:_Enumerating_key_within__s
call fcn.00449974
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0xc08]
add esp, 0xc
mov esi, ebx
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x804]
push eax
push ebx
jmp 0x42b098
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x404]
push eax
push 0x66c218
lea eax, [ebp - 0xc04]
push 0x400
push eax
call fcn.00445d6d
lea eax, [ebp - 0xc04]
push eax
call fcn.0042adcb
add esp, 0x18
lea eax, [ebp - 0xc08]
inc esi
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp - 0xc0c]
mov dword [ebp - 0xc08], 0x400
call edi
test eax, eax
je 0x42b051
push eax
push str.RecoverFlingFTPPasswords
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0xc0c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x42b0df
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d4
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3eb]
xor ebx, ebx
push 0x3e7
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.00626f50
push esi
push str.RecoverFlylinkDCPasswords
push str._n__s_Entered_____s_
call fcn.00449974
push esi
call fcn.00631510
add esp, 0x1c
cmp eax, 1
lea eax, [ebp - 0x3ec]
jbe 0x42b1ad
push esi
mov esi, 0x3e8
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
add esp, 0x10
cmp byte [ebp + eax - 0x3ed], 0x5c
jne 0x42b178
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
dec eax
pop ecx
cmp eax, esi
jae 0x42b306
mov byte [ebp + eax - 0x3ec], bl
push str.Favorites.xml
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x3ec]
push eax
call fcn.00449791
add esp, 0x10
test eax, eax
je 0x42b2f5
lea eax, [ebp - 0x3ec]
push eax
jmp 0x42b2e9
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [ebp - 0x3ec], bl
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov esi, 0x3e8
test eax, eax
js 0x42b216
push str.FlylinkDCFavorites.xml
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x3ec]
push eax
push str.RecoverFlylinkDCPasswords
push str._n__s_Checking_in_appdata_location_____s_
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
call fcn.00449791
add esp, 0x1c
test eax, eax
je 0x42b216
lea eax, [ebp - 0x3ec]
push eax
push 0x2e0
call fcn.00424d47
pop ecx
pop ecx
lea eax, [ebp - 0x3ec]
mov byte [ebp - 0x3ec], bl
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x42b280
push str.FlylinkDCSettingsFavorites.xml
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x3ec]
push eax
push str.RecoverFlylinkDCPasswords
push str._n__s_Checking_in_program_files_location_____s_
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
call fcn.00449791
add esp, 0x1c
test eax, eax
je 0x42b280
lea eax, [ebp - 0x3ec]
push eax
push 0x2e0
call fcn.00424d47
pop ecx
pop ecx
cmp dword [0x716864], ebx
je 0x42b2f5
push 0x3e4
lea eax, [ebp - 0x7d0]
mov dword [ebp - 0x7d4], 0x5c3a43
push ebx
push eax
call fcn.00626f50
add esp, 0xc
lea eax, [ebp - 0x7d4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx eax, byte [ebp - 0x7d4]
push eax
push str._c:Program_FilesFlylinkDCSettingsFavorites.xml
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3ec]
push eax
call fcn.00449791
add esp, 0x14
test eax, eax
je 0x42b2f5
lea ecx, [ebp - 0x3ec]
push ecx
push 0x2e0
call fcn.00424d47
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3