joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e87
Capabilities:
Gather ffftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406082
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x405edf
jmp 0x40607a
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415af8
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push str.HostAdrs
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push 0x415b01
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDir
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x415b1d
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
or eax, eax
je 0x405fb9
cmp dword [ebp - 0x828], 4
jne 0x405fb9
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.004018b8
jmp 0x405fcd
or eax, eax
je 0x405fc3
push eax
call fcn.004018b8
mov dword [ebp - 0x824], 0x15
cmp dword [ebp - 0x81c], 0
je 0x40603b
cmp dword [ebp - 0x814], 0
je 0x40603b
cmp dword [ebp - 0x818], 0
je 0x40603b
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x405eb1
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40611f
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406303
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406177
jmp 0x4062fb
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415b39
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push 0x415b22
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push 0x415b2b
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x820], eax
push 0
push 0x415b30
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x818], eax
push 0
push str.HostDirName
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
je 0x4062a3
cmp dword [ebp - 0x814], 0
je 0x4062a3
cmp dword [ebp - 0x818], 0
je 0x4062a3
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040611f
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x406149
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406338
Capabilities:
Gather coreftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406595
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406390
jmp 0x40658d
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d87
mov dword [ebp - 0x810], eax
push 0
push 0x415baa
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push 0x415b9b
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push 0x415ba0
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x818], eax
push 0
push str.PthR
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x82c]
push eax
push 0x415ba5
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
or eax, eax
je 0x406464
cmp dword [ebp - 0x82c], 4
jne 0x406464
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.004018b8
jmp 0x406478
or eax, eax
je 0x40646e
push eax
call fcn.004018b8
mov dword [ebp - 0x824], 0x15
lea eax, [ebp - 0x830]
push eax
push 0x415bb2
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x81c], 0
je 0x406543
cmp dword [ebp - 0x814], 0
je 0x406543
cmp dword [ebp - 0x818], 0
je 0x406543
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
cmp dword [ebp - 0x828], 0
je 0x406539
cmp dword [ebp - 0x830], 4
jne 0x406539
mov eax, dword [ebp - 0x828]
push dword [eax]
push dword [ebp + 8]
call fcn.00401569
jmp 0x406543
push 0
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x828]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x406362
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4065ca
Capabilities:
Gather ftp-explorer information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7cc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40684c
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406622
jmp 0x406844
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d87
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x834]
push eax
push 0x415c34
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push 0x415c4a
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push str.Login
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x818], eax
push 0
push str.InitialPath
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x415c55
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
or eax, eax
je 0x4066f5
cmp dword [ebp - 0x828], 4
jne 0x4066f5
push dword [eax]
pop dword [ebp - 0x824]
jmp 0x4066ff
mov dword [ebp - 0x824], 0x15
push eax
call fcn.004018b8
lea eax, [ebp - 0x830]
push eax
push str.PasswordType
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
or eax, eax
je 0x406739
cmp dword [ebp - 0x830], 4
jne 0x406739
push dword [eax]
pop dword [ebp - 0x82c]
jmp 0x406743
mov dword [ebp - 0x82c], 0
push eax
call fcn.004018b8
cmp dword [ebp - 0x81c], 0
je 0x406791
cmp dword [ebp - 0x82c], 2
jne 0x406791
push 0
lea eax, [ebp - 0x834]
push eax
push dword [ebp - 0x81c]
call fcn.00404317
or eax, eax
je 0x40677c
cmp dword [ebp - 0x834], 0
jne 0x406791
push dword [ebp - 0x81c]
call fcn.004018b8
mov dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
je 0x406805
cmp dword [ebp - 0x814], 0
je 0x406805
cmp dword [ebp - 0x818], 0
je 0x406805
push 0xbeef0002
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x834]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040159f
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x4065f4
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406a56
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406c1a
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406aae
jmp 0x406c12
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415d04
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push 0x415cf4
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push 0x415cfb
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FtpPort
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
or eax, eax
je 0x406b6a
cmp dword [ebp - 0x824], 4
jne 0x406b6a
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004018b8
jmp 0x406b7e
or eax, eax
je 0x406b74
push eax
call fcn.004018b8
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406bde
cmp dword [ebp - 0x814], 0
je 0x406bde
cmp dword [ebp - 0x818], 0
je 0x406bde
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x406a80
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406c8a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406e7a
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406ce2
jmp 0x406e72
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
lea eax, [ebp - 0x828]
push eax
push 0x415d5d
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push str.Hostname
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push str.Username
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push 0x415d66
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
or eax, eax
je 0x406da3
cmp dword [ebp - 0x824], 4
jne 0x406da3
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004018b8
jmp 0x406db7
or eax, eax
je 0x406dad
push eax
call fcn.004018b8
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406e3e
cmp dword [ebp - 0x814], 0
je 0x406e3e
cmp dword [ebp - 0x818], 0
je 0x406e3e
push 0
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x81c]
call fcn.00404317
or eax, eax
je 0x406e3e
cmp dword [ebp - 0x828], 0
je 0x406e3e
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x828]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040159f
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x406cb4
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4070b7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407295
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40710c
jmp 0x40728d
push 0x414c17
push dword [ebp + 0x10]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415de5
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push str._Password
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x820], eax
push 0
push str.Server
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push 0x415ddc
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x818], eax
push 0
push str.Directory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x4071cd
cmp dword [ebp - 0x820], 0
je 0x407232
cmp dword [ebp - 0x814], 0
je 0x407232
cmp dword [ebp - 0x818], 0
je 0x407232
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004070b7
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x4070de
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x4072e2
Capabilities:
Gather fling-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4074c0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x407337
jmp 0x4074b8
push 0x414c17
push dword [ebp + 0x10]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push str.FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push str._FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x820], eax
push 0
push str.FtpServer
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push str.FtpUserName
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x818], eax
push 0
push str.FtpDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x4073f8
cmp dword [ebp - 0x820], 0
je 0x40745d
cmp dword [ebp - 0x814], 0
je 0x40745d
cmp dword [ebp - 0x818], 0
je 0x40745d
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004072e2
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x407309
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40750d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4075bc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x40755f
jmp 0x4075b4
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x810], eax
or eax, eax
je 0x4075a4
cmp dword [ebp - 0x814], 0
je 0x4075a4
push 0xbeef0000
push dword [ebp - 0x814]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00403f52
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x407534
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x4076d1
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401dec
or eax, eax
je 0x40778a
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x4076fe
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00401d87
mov dword [ebp - 4], eax
push str.SharedSettings.ccs
push dword [ebp - 4]
call fcn.00401d33
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403fa7
call fcn.004018b8
push str.SharedSettings.sqlite
push dword [ebp - 4]
call fcn.00401d33
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403fa7
call fcn.004018b8
push str.SharedSettings_1_0_5.ccs
push dword [ebp - 4]
call fcn.00401d33
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403fa7
call fcn.004018b8
push str.SharedSettings_1_0_5.sqlite
push dword [ebp - 4]
call fcn.00401d33
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403fa7
call fcn.004018b8
push dword [ebp - 4]
call fcn.004018b8
leave
ret 0xc
Function at 0x407803
Capabilities:
Gather leapftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40796a
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x407858
jmp 0x407962
push 0x414c17
push dword [ebp + 0x10]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push str.InstallPath
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push 0x415fca
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 0
je 0x4078ef
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.0040428c
push 0xbeef0001
push 0x415f90
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.0040428c
cmp dword [ebp - 0x818], 0
je 0x407928
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040428c
push 0xbeef0001
push 0x415f90
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040428c
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407803
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40782a
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc