Function at 0x425ad0
Capabilities:
Execute vbscript javascript or jscript in memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426eab
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x432040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
call fcn.004084b0
mov dword [ebp - 0xb4], 0
push str.FTPTEST.vbs
lea ecx, [ebp - 0x30]
call fcn.00409b10
mov dword [ebp - 4], 0
mov dword [ebp - 0x74], 1
mov dword [ebp - 0xb8], 0
mov byte [ebp - 0x29], 0
lea eax, [ebp - 0x40]
push eax
push 0x4272d0
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [edx]
call ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x74], 1
jne 0x425b98
lea edx, [ebp - 0x20]
push edx
push str.VBScript
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425b93
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0xb0]
jmp 0x42610f
jmp 0x425dec
cmp dword [ebp - 0x74], 2
jne 0x425dec
push 0x42d2f8
lea ecx, [ebp - 0x34]
call fcn.00409b10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00409db0
movzx ecx, al
test ecx, ecx
je 0x425c21
lea edx, [ebp - 0x20]
push edx
push str.JScript
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425c18
push 0x10
push str.FOP_FTP_2014
push str.JScript_is_not_available_on_this_computer.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00409af0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0x78]
jmp 0x42610f
mov byte [ebp - 0x29], 1
jmp 0x425ddf
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00409b90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.00409660
nop
push 0
push str.chakra
lea ecx, [ebp - 0x38]
call fcn.004096b0
test eax, eax
jl 0x425cb4
lea edx, [ebp - 0x20]
push edx
push str.1b7cd997_e5ff_4932_a7a6_2a9e636da385
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jge 0x425caf
push 0x10
push str.FOP_FTP_2014
push str.Chakra_is_not_available_on_this_computer.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00409af0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00409af0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0x7c]
jmp 0x42610f
jmp 0x425dd2
push 0
push str.jscript9
lea ecx, [ebp - 0x38]
call fcn.004096b0
test eax, eax
jl 0x425d32
lea ecx, [ebp - 0x20]
push ecx
push str.16d51579_a30b_4c8b_a276_0ff4dc41e755
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jge 0x425d29
push 0x10
push str.FOP_FTP_2014
push str.JScript_v9_is_not_available_on_this_computer.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x80], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00409af0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00409af0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0x80]
jmp 0x42610f
mov byte [ebp - 0x29], 1
jmp 0x425dd2
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x34]
call fcn.00401a90
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jge 0x425dd2
push str._is_not_available_on_this_computer.
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x88]
push edx
call fcn.00409350
add esp, 0xc
mov dword [ebp - 0x84], eax
push 0x10
push str.FOP_FTP_2014
mov ecx, dword [ebp - 0x84]
call fcn.00401a90
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x88]
call fcn.00409af0
nop
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00409af0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00409af0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0x8c]
jmp 0x42610f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00409af0
nop
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00409af0
nop
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401aa0
push eax
push 0x4272e0
push 1
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425e37
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x90], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0x90]
jmp 0x42610f
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x425ebd
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a90
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x3c]
push ecx
push 0x427300
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
mov edx, dword [ecx]
call edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x425ebd
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, 3
mov word [ebp - 0xc8], cx
mov dword [ebp - 0xc0], 2
lea edx, [ebp - 0xc8]
push edx
push 0
push 0x4000
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [edx + 8]
call ecx
nop
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a90
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x60
call fcn.00401aa0
push eax
push 0x4272f0
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
mov edx, dword [ecx]
call edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425f15
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x94], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0x94]
jmp 0x42610f
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a90
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425f61
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x98], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0x98]
jmp 0x42610f
mov ecx, dword [ebp - 0x28]
add ecx, 0x60
call fcn.00401a90
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [edx + 0xc]
call ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425fa9
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x9c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0x9c]
jmp 0x42610f
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a90
mov dword [ebp - 0x60], eax
push 6
push 0x42d528
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x60]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425ff8
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0xa0]
jmp 0x42610f
mov edx, dword [ebp - 0x40]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [eax + 4]
call edx
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x50], 0
mov dword [ebp - 0xa4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0x60
call fcn.00401a90
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0xe8]
push ecx
push 0
push 0x42
push 0
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x50]
push eax
push 0
mov ecx, dword [ebp - 0xa4]
push ecx
push 0
push str._r_nusername_PH18183056201__r_npwd___kd8mv4NI_godaddy___r_nftpsite_50.63.8.132__r_nlocal_folder___C:_BW_BearwareSupportFOPBackEndZip__r_nremote_folder__httpdocs_backup_mytest__r_n_r_n_r_ncurrentdir__Left_WScript.ScriptFullName__InStrRev_WScript.ScriptFullName_____1__r_n_r_nSet_fso__CreateObject__Scripting.Filesystemobject___r_n_r_nSet_file__fso.CreateTextFile_currentdir____ftp.txt__1__r_nfile.WriteLine_username_r_nfile.WriteLine_pwd_r_nfile.WriteLine__Binary__r_nfile.WriteLine__lcd______local_folder_______r_nfile.WriteLine__cd____remote_folder_r_n_r_nFor_each_filename_In_fso.GetFolder_local_folder_.Files_r_n__file.WriteLine__put____filename.Name_r_nNext_r_n_r_nfile.WriteLine__bye__r_nfile.Close_r_n_r_nSet_WshShell__CreateObject__wscript.Shell___r_nWshShell.Run__cmd.exe__c_ftp.exe__i__s:___currentdir____ftp.txt____ftpsite________currentdir____ftp.log_2_1__1_True_r_n_r_n
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push eax
mov edx, dword [ebp - 0x64]
push edx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x42608d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0xa8]
jmp 0x42610f
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a90
mov dword [ebp - 0x68], eax
push 2
mov ecx, dword [ebp - 0x68]
push ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
mov ecx, dword [eax + 0x14]
call ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a90
mov dword [ebp - 0x6c], eax
push 3
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a90
mov dword [ebp - 0x70], eax
push 4
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409af0
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e737
mov esp, ebp
pop ebp
ret