joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40657e
Capabilities:
Gather ftp-explorer information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7cc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x4150e8]
call fcn.0041104e
and eax, eax
jne 0x406800
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je 0x4065d6
jmp 0x4067f8
push 0x4150c4
push dword [ebp + 0xc]
call fcn.00401db1
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e05
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x834]
push eax
push 0x4160f7
push dword [ebp - 0x810]
push dword [0x4150e8]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push 0x41610d
push dword [ebp - 0x810]
push dword [0x4150e8]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push 0x416112
push dword [ebp - 0x810]
push dword [0x4150e8]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
push 0
push 0x41611d
push dword [ebp - 0x810]
push dword [0x4150e8]
call fcn.00401d2a
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x416118
push dword [ebp - 0x810]
push dword [0x4150e8]
call fcn.00401d2a
and eax, eax
je 0x4066a9
cmp dword [ebp - 0x828], 4
jne 0x4066a9
push dword [eax]
pop dword [ebp - 0x824]
jmp 0x4066b3
mov dword [ebp - 0x824], 0x15
push eax
call fcn.00401871
lea eax, [ebp - 0x830]
push eax
push 0x416100
push dword [ebp - 0x810]
push dword [0x4150e8]
call fcn.00401d2a
and eax, eax
je 0x4066ed
cmp dword [ebp - 0x830], 4
jne 0x4066ed
push dword [eax]
pop dword [ebp - 0x82c]
jmp 0x4066f7
mov dword [ebp - 0x82c], 0
push eax
call fcn.00401871
cmp dword [ebp - 0x81c], 0
je 0x406745
cmp dword [ebp - 0x82c], 2
jne 0x406745
push 0
lea eax, [ebp - 0x834]
push eax
push dword [ebp - 0x81c]
call fcn.0040427f
and eax, eax
je 0x406730
cmp dword [ebp - 0x834], 0
jne 0x406745
push dword [ebp - 0x81c]
call fcn.00401871
mov dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
je 0x4067b9
cmp dword [ebp - 0x814], 0
je 0x4067b9
cmp dword [ebp - 0x818], 0
je 0x4067b9
push 0xbeef0002
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x834]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401558
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x4065a8
push dword [ebp - 4]
call fcn.00411048
leave
ret 8
Function at 0x407296
Capabilities:
Gather fling-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041104e
and eax, eax
jne 0x407474
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je 0x4072eb
jmp 0x40746c
push 0x4150c4
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0x416308
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push 0x416314
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x820], eax
push 0
push 0x4162f2
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push 0x4162fc
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
push 0
push 0x416321
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x4073ac
cmp dword [ebp - 0x820], 0
je 0x407411
cmp dword [ebp - 0x814], 0
je 0x407411
cmp dword [ebp - 0x818], 0
je 0x407411
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407296
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x4072bd
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc

Function at 0x407685
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401e6a
and eax, eax
je 0x40773e
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x4076b2
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00401e05
mov dword [ebp - 4], eax
push 0x4163c0
push dword [ebp - 4]
call fcn.00401db1
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push 0x4163ee
push dword [ebp - 4]
call fcn.00401db1
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push 0x4163d4
push dword [ebp - 4]
call fcn.00401db1
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push 0x416405
push dword [ebp - 4]
call fcn.00401db1
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
leave
ret 0xc
Function at 0x4077b7
Capabilities:
Gather leapftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041104e
and eax, eax
jne 0x40791e
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je 0x40780c
jmp 0x407916
push 0x4150c4
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0x416481
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push 0x41648d
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 0
je 0x4078a3
push 0xbeef0000
push 0x416449
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004041f4
push 0xbeef0001
push 0x416453
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004041f4
cmp dword [ebp - 0x818], 0
je 0x4078dc
push 0xbeef0000
push 0x416449
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004041f4
push 0xbeef0001
push 0x416453
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004041f4
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004077b7
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x4077de
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc
Function at 0x407aa5
Capabilities:
Gather winscp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041104e
and eax, eax
jne 0x407d07
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je 0x407afa
jmp 0x407cff
push 0x4150c4
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0x416495
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push 0x41649e
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push 0x4164a7
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
push 0
push 0x4164b0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x820]
push eax
push 0x4164c0
push dword [ebp - 0x810]
push dword [0x4150e8]
call fcn.00401d2a
and eax, eax
je 0x407bc8
cmp dword [ebp - 0x820], 4
jne 0x407bc8
push dword [eax]
pop dword [ebp - 0x828]
push eax
call fcn.00401871
jmp 0x407bdc
and eax, eax
je 0x407bd2
push eax
call fcn.00401871
mov dword [ebp - 0x828], 0x15
lea eax, [ebp - 0x830]
push eax
push 0x4164cb
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407ca4
cmp dword [ebp - 0x814], 0
je 0x407ca4
cmp dword [ebp - 0x818], 0
je 0x407ca4
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401584
cmp dword [ebp - 0x82c], 0
je 0x407c9a
cmp dword [ebp - 0x830], 4
jne 0x407c9a
mov eax, dword [ebp - 0x82c]
push dword [eax]
push dword [ebp + 8]
call fcn.00401522
jmp 0x407ca4
push 0
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x82c]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407aa5
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x407acc
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc
Function at 0x407df7
Capabilities:
Gather southriver-webdrive information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041104e
and eax, eax
jne 0x40800b
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je 0x407e4c
jmp 0x408003
push 0x4150c4
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
lea eax, [ebp - 0x820]
push eax
push 0x416512
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push 0x41651b
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push 0x41651f
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
push 0
push 0x416528
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x824], eax
push 0
push 0x416536
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x828], eax
push 0
push 0x416572
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407f9d
cmp dword [ebp - 0x814], 0
je 0x407f9d
cmp dword [ebp - 0x818], 0
je 0x407f9d
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x820]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401558
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x82c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x828]
call fcn.00401871
push dword [ebp - 0x82c]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407df7
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x407e1e
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc
Function at 0x408d0a
Capabilities:
Gather wise-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041104e
and eax, eax
jne 0x408e48
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je 0x408d5f
jmp 0x408e40
push 0x4150c4
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push dword [ebp - 0x814]
call fcn.004023e6
and eax, eax
je 0x408e11
push eax
mov dword [ebp - 0x818], eax
push dword [ebp - 0x818]
call fcn.00401f38
and eax, eax
je 0x408e0c
push 0xbeef0002
push 0x4166e6
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004041f4
push 0xbeef0002
push 0x4166f6
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004041f4
push 0xbeef0000
push 0x41663a
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004041f4
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408d0a
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x408d31
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc
Function at 0x40d19a
Capabilities:
Gather robo-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041104e
and eax, eax
jne 0x40d3ef
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je 0x40d1ef
jmp 0x40d3e7
push 0x4150c4
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x814], eax
call fcn.00401871
lea eax, [ebp - 0xc]
push eax
push 0x416fe7
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x828], eax
push 0
push 0x416ff0
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
push 0
push 0x416ffb
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x82c]
push eax
push 0x417013
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d2a
and eax, eax
je 0x40d2a1
cmp dword [ebp - 0x82c], 4
jne 0x40d2a1
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.00401871
jmp 0x40d2b5
and eax, eax
je 0x40d2ab
push eax
call fcn.00401871
mov dword [ebp - 0x820], 0x15
push 0
push 0x417002
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x824], eax
push 0
push 0x41701e
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x828], 0
je 0x40d38c
push 0x417029
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x828]
call fcn.0040427f
and eax, eax
je 0x40d38c
cmp dword [ebp - 0xc], 0
je 0x40d38c
cmp dword [ebp - 0x81c], 0
je 0x40d38c
cmp dword [ebp - 0x818], 0
je 0x40d38c
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0xc]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401558
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x830]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x828]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x830]
call fcn.00401871
push dword [ebp - 0x814]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d19a
push dword [ebp - 0x814]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40d1c1
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc
Function at 0x40d3f3
Capabilities:
Gather robo-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push 0x416fd2
push 0x416f93
push dword [ebp + 0xc]
call fcn.00401d2a
and eax, eax
je 0x40d47e
push eax
cmp dword [ebp - 4], 4
jne 0x40d479
push dword [eax]
pop dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jbe 0x40d42f
mov dword [ebp - 8], 0x1f4
jmp 0x40d473
push dword [ebp - 8]
push 0x416fdc
lea eax, [ebp - 0x1c]
push eax
call fcn.00411036
add esp, 0xc
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x416f93
push dword [ebp + 0xc]
call fcn.00401d2a
and eax, eax
je 0x40d470
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x40d431
call fcn.00401871
leave
ret 8
Function at 0x40dd8a
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041104e
and eax, eax
jne 0x40dfbf
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je 0x40dddf
jmp 0x40dfb7
push 0x4150c4
push dword [ebp + 0xc]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x828], eax
call fcn.00401871
push 0
push 0x417159
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x810], eax
push 0
push 0x417170
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push 0x417185
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push 0x41719e
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push 0x4171b3
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x830]
push eax
push 0x4171cb
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x810], 0
je 0x40df27
cmp dword [ebp - 0x814], 0
je 0x40df27
cmp dword [ebp - 0x818], 0
je 0x40df27
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.00401522
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.00401558
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.00401584
cmp dword [ebp - 0x830], 0
je 0x40df51
push 0xbeef0001
push dword [ebp + 0x10]
call fcn.00401522
push dword [ebp - 0x830]
push dword [ebp - 0x82c]
push dword [ebp + 0x10]
call fcn.00401558
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040dd8a
push dword [ebp - 0x828]
call fcn.00401871
push dword [ebp - 0x810]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
push dword [ebp - 0x82c]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40ddb1
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc
Function at 0x40e35f
Capabilities:
Gather winzip information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041104e
and eax, eax
jne 0x40e4a4
push 0
push 0x4172cc
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 8], eax
push 0
push 0x4172d1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
push 0x4172d8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x10], eax
push 0
push 0x4172df
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x14], eax
push 0
push 0x4172e4
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
je 0x40e474
cmp dword [ebp - 0x1c], 0
je 0x40e474
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.00402ad7
and eax, eax
je 0x40e474
shr dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.0040427f
and eax, eax
je 0x40e474
cmp dword [ebp - 8], 0
je 0x40e474
cmp dword [ebp - 0xc], 0
je 0x40e474
cmp dword [ebp - 0x10], 0
je 0x40e474
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.00401522
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.00401558
push dword [ebp - 0x14]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x18]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 8]
call fcn.00401871
push dword [ebp - 0xc]
call fcn.00401871
push dword [ebp - 0x10]
call fcn.00401871
push dword [ebp - 0x14]
call fcn.00401871
push dword [ebp - 0x18]
call fcn.00401871
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc

Function at 0x410395
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
xor edx, eax
xor eax, edx
xor edx, eax
push 0x4103af
nop
clc
nop
jb 0x4103ae
nop
ret
inc bh
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov edi, 0x417d01
push dword [ebp + 8]
pop dword [0x417f21]
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x4103d8
push dword [ebp + 8]
call fcn.00401026
jmp 0x410495
call fcn.004023c5
push dword [ebp + 8]
call fcn.004014db
mov dword [0x417f1d], eax
push dword fs:[0]
mov eax, esp
push dword fs:[0]
push ebp
push eax
push 0x41048b
push 0x410444
push eax
mov dword fs:[0], esp
push dword [ebp + 8]
call dword [edi]
cmp dword [edi], 0x4044a0
je 0x41043f
cmp eax, 0x10
je 0x41042e
mov dword [ebp - 4], 1
jmp 0x41043f
push dword [0x417f1d]
push dword [0x417f21]
call fcn.0040130e
add esp, 0x18
jmp 0x41048b
pop dword fs:[0]
add edi, 4
cmp dword [edi], 0
jne 0x4103dd
mov eax, dword [ebp - 4]
pop edi
leave
ret 4
Function at 0x4103af
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
xor edx, eax
xor eax, edx
xor edx, eax
push 0x4103af
nop
clc
nop
jb 0x4103ae
nop
ret
inc bh
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov edi, 0x417d01
push dword [ebp + 8]
pop dword [0x417f21]
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x4103d8
push dword [ebp + 8]
call fcn.00401026
jmp 0x410495
call fcn.004023c5
push dword [ebp + 8]
call fcn.004014db
mov dword [0x417f1d], eax
push dword fs:[0]
mov eax, esp
push dword fs:[0]
push ebp
push eax
push 0x41048b
push 0x410444
push eax
mov dword fs:[0], esp
push dword [ebp + 8]
call dword [edi]
cmp dword [edi], 0x4044a0
je 0x41043f
cmp eax, 0x10
je 0x41042e
mov dword [ebp - 4], 1
jmp 0x41043f
push dword [0x417f1d]
push dword [0x417f21]
call fcn.0040130e
add esp, 0x18
jmp 0x41048b
pop dword fs:[0]
add edi, 4
cmp dword [edi], 0
jne 0x4103dd
mov eax, dword [ebp - 4]
pop edi
leave
ret 4