joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e01
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x405fe5
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x405e59
jmp 0x405fdd
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push 0x412689
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push 0x412672
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push 0x41267b
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x820], eax
push 0
push 0x412680
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x818], eax
push 0
push str.HostDirName
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
je 0x405f85
cmp dword [ebp - 0x814], 0
je 0x405f85
cmp dword [ebp - 0x818], 0
je 0x405f85
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x820]
call fcn.00401752
push dword [ebp - 0x824]
call fcn.00401752
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00405e01
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x405e2b
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40601a
Capabilities:
Gather coreftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406277
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406072
jmp 0x40626f
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401c21
mov dword [ebp - 0x810], eax
push 0
push 0x4126fa
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push 0x4126eb
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push 0x4126f0
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x818], eax
push 0
push str.PthR
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x82c]
push eax
push 0x4126f5
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
or eax, eax
je 0x406146
cmp dword [ebp - 0x82c], 4
jne 0x406146
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.00401752
jmp 0x40615a
or eax, eax
je 0x406150
push eax
call fcn.00401752
mov dword [ebp - 0x824], 0x15
lea eax, [ebp - 0x830]
push eax
push 0x412702
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x81c], 0
je 0x406225
cmp dword [ebp - 0x814], 0
je 0x406225
cmp dword [ebp - 0x818], 0
je 0x406225
push 0xbeef0010
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
cmp dword [ebp - 0x828], 0
je 0x40621b
cmp dword [ebp - 0x830], 4
jne 0x40621b
mov eax, dword [ebp - 0x828]
push dword [eax]
push dword [ebp + 8]
call fcn.004014e6
jmp 0x406225
push 0
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x820]
call fcn.00401752
push dword [ebp - 0x828]
call fcn.00401752
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x406044
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4062ac
Capabilities:
Gather ftp-explorer information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7cc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40652e
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406304
jmp 0x406526
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401c21
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x834]
push eax
push 0x412784
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push 0x41279a
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push str.Login
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x818], eax
push 0
push str.InitialPath
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x4127a5
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
or eax, eax
je 0x4063d7
cmp dword [ebp - 0x828], 4
jne 0x4063d7
push dword [eax]
pop dword [ebp - 0x824]
jmp 0x4063e1
mov dword [ebp - 0x824], 0x15
push eax
call fcn.00401752
lea eax, [ebp - 0x830]
push eax
push str.PasswordType
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
or eax, eax
je 0x40641b
cmp dword [ebp - 0x830], 4
jne 0x40641b
push dword [eax]
pop dword [ebp - 0x82c]
jmp 0x406425
mov dword [ebp - 0x82c], 0
push eax
call fcn.00401752
cmp dword [ebp - 0x81c], 0
je 0x406473
cmp dword [ebp - 0x82c], 2
jne 0x406473
push 0
lea eax, [ebp - 0x834]
push eax
push dword [ebp - 0x81c]
call fcn.00403ff9
or eax, eax
je 0x40645e
cmp dword [ebp - 0x834], 0
jne 0x406473
push dword [ebp - 0x81c]
call fcn.00401752
mov dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
je 0x4064e7
cmp dword [ebp - 0x814], 0
je 0x4064e7
cmp dword [ebp - 0x818], 0
je 0x4064e7
push 0xbeef0002
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x834]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040151c
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x820]
call fcn.00401752
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x4062d6
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406738
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4068fc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406790
jmp 0x4068f4
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push 0x412854
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push 0x412844
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push 0x41284b
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FtpPort
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
or eax, eax
je 0x40684c
cmp dword [ebp - 0x824], 4
jne 0x40684c
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.00401752
jmp 0x406860
or eax, eax
je 0x406856
push eax
call fcn.00401752
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x4068c0
cmp dword [ebp - 0x814], 0
je 0x4068c0
cmp dword [ebp - 0x818], 0
je 0x4068c0
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x406762
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406931
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406b21
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406989
jmp 0x406b19
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
lea eax, [ebp - 0x828]
push eax
push 0x412897
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push str.Hostname
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push str.Username
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push 0x4128a0
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
or eax, eax
je 0x406a4a
cmp dword [ebp - 0x824], 4
jne 0x406a4a
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.00401752
jmp 0x406a5e
or eax, eax
je 0x406a54
push eax
call fcn.00401752
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406ae5
cmp dword [ebp - 0x814], 0
je 0x406ae5
cmp dword [ebp - 0x818], 0
je 0x406ae5
push 0
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x81c]
call fcn.00403ff9
or eax, eax
je 0x406ae5
cmp dword [ebp - 0x828], 0
je 0x406ae5
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x828]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040151c
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x40695b
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406d5e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406f3c
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406db3
jmp 0x406f34
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push 0x41291f
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push str._Password
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x820], eax
push 0
push str.Server
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push 0x412916
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x818], eax
push 0
push str.Directory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x406e74
cmp dword [ebp - 0x820], 0
je 0x406ed9
cmp dword [ebp - 0x814], 0
je 0x406ed9
cmp dword [ebp - 0x818], 0
je 0x406ed9
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x820]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x824]
call fcn.00401752
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406d5e
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x406d85
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x406f89
Capabilities:
Gather fling-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407167
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406fde
jmp 0x40715f
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push str.FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push str._FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x820], eax
push 0
push str.FtpServer
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push str.FtpUserName
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x818], eax
push 0
push str.FtpDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x40709f
cmp dword [ebp - 0x820], 0
je 0x407104
cmp dword [ebp - 0x814], 0
je 0x407104
cmp dword [ebp - 0x818], 0
je 0x407104
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x820]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x824]
call fcn.00401752
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406f89
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x406fb0
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x4071b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407263
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x407206
jmp 0x40725b
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x810], eax
or eax, eax
je 0x40724b
cmp dword [ebp - 0x814], 0
je 0x40724b
push 0xbeef0000
push dword [ebp - 0x814]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00403c34
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x4071db
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x407378
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401c86
or eax, eax
je 0x407431
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x4073a5
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00401c21
mov dword [ebp - 4], eax
push str.SharedSettings.ccs
push dword [ebp - 4]
call fcn.00401bcd
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403c89
call fcn.00401752
push str.SharedSettings.sqlite
push dword [ebp - 4]
call fcn.00401bcd
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403c89
call fcn.00401752
push str.SharedSettings_1_0_5.ccs
push dword [ebp - 4]
call fcn.00401bcd
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403c89
call fcn.00401752
push str.SharedSettings_1_0_5.sqlite
push dword [ebp - 4]
call fcn.00401bcd
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403c89
call fcn.00401752
push dword [ebp - 4]
call fcn.00401752
leave
ret 0xc
Function at 0x4074aa
Capabilities:
Gather leapftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407611
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4074ff
jmp 0x407609
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push str.InstallPath
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push 0x412b04
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 0
je 0x407596
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00403f6e
push 0xbeef0001
push 0x412aca
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00403f6e
cmp dword [ebp - 0x818], 0
je 0x4075cf
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00403f6e
push 0xbeef0001
push 0x412aca
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00403f6e
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004074aa
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x4074d1
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40779c
Capabilities:
Gather winscp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4079fe
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4077f1
jmp 0x4079f6
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push 0x412b0c
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push 0x412b15
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push 0x412b1e
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x820]
push eax
push 0x412b37
push dword [ebp - 0x810]
push dword [0x411827]
call fcn.00401b46
or eax, eax
je 0x4078bf
cmp dword [ebp - 0x820], 4
jne 0x4078bf
push dword [eax]
pop dword [ebp - 0x828]
push eax
call fcn.00401752
jmp 0x4078d3
or eax, eax
je 0x4078c9
push eax
call fcn.00401752
mov dword [ebp - 0x828], 0x15
lea eax, [ebp - 0x830]
push eax
push str.FSProtocol
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x40799b
cmp dword [ebp - 0x814], 0
je 0x40799b
cmp dword [ebp - 0x818], 0
je 0x40799b
push 0xbeef0010
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
cmp dword [ebp - 0x82c], 0
je 0x407991
cmp dword [ebp - 0x830], 4
jne 0x407991
mov eax, dword [ebp - 0x82c]
push dword [eax]
push dword [ebp + 8]
call fcn.004014e6
jmp 0x40799b
push 0
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x824]
call fcn.00401752
push dword [ebp - 0x82c]
call fcn.00401752
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040779c
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x4077c3
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc