joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405352
Capabilities:
Gather flashfxp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401e2e
or eax, eax
je 0x4053ae
mov dword [ebp - 4], eax
push 0xbeef0000
push str.Sites.dat
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00405307
push 0xbeef0001
push str.Quick.dat
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00405307
push 0xbeef0002
push 0x415300
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00405307
push dword [ebp - 4]
call fcn.00401835
leave
ret 8

Function at 0x405769
Capabilities:
Gather filezilla information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push 0xbeef0013
push str.Server_Type
push 0x4153b0
push 0x4153ab
push 0x4153a1
push 0x41539c
push 0x4153a6
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405609
push 0xbeef0013
push 0x4153fc
push 0x4153f7
push str.Server.Port
push str.Server.User
push str.Server.Host
push str.Server.Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405609
push 0xbeef0014
push str.Last_Server_Type
push str.Last_Server_Path
push str.Last_Server_Port
push str.Last_Server_User
push str.Last_Server_Host
push str.Last_Server_Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405609
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40588c
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x405844
jmp 0x405884
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401dc9
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00405769
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x405819
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x405d11
Capabilities:
Gather ffftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x405f0c
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x405d69
jmp 0x405f04
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push 0x415662
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push str.HostAdrs
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push 0x41566b
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDir
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x415687
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
or eax, eax
je 0x405e43
cmp dword [ebp - 0x828], 4
jne 0x405e43
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.00401835
jmp 0x405e57
or eax, eax
je 0x405e4d
push eax
call fcn.00401835
mov dword [ebp - 0x824], 0x15
cmp dword [ebp - 0x81c], 0
je 0x405ec5
cmp dword [ebp - 0x814], 0
je 0x405ec5
cmp dword [ebp - 0x818], 0
je 0x405ec5
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x820]
call fcn.00401835
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x405d3b
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x405fa9
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40618d
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406001
jmp 0x406185
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push 0x4156a3
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push 0x41568c
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push 0x415695
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x820], eax
push 0
push 0x41569a
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x818], eax
push 0
push str.HostDirName
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
je 0x40612d
cmp dword [ebp - 0x814], 0
je 0x40612d
cmp dword [ebp - 0x818], 0
je 0x40612d
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x820]
call fcn.00401835
push dword [ebp - 0x824]
call fcn.00401835
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00405fa9
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x405fd3
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4061c2
Capabilities:
Gather coreftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40641f
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40621a
jmp 0x406417
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401dc9
mov dword [ebp - 0x810], eax
push 0
push 0x415714
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push 0x415705
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push 0x41570a
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x818], eax
push 0
push str.PthR
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x82c]
push eax
push 0x41570f
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
or eax, eax
je 0x4062ee
cmp dword [ebp - 0x82c], 4
jne 0x4062ee
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.00401835
jmp 0x406302
or eax, eax
je 0x4062f8
push eax
call fcn.00401835
mov dword [ebp - 0x824], 0x15
lea eax, [ebp - 0x830]
push eax
push 0x41571c
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x81c], 0
je 0x4063cd
cmp dword [ebp - 0x814], 0
je 0x4063cd
cmp dword [ebp - 0x818], 0
je 0x4063cd
push 0xbeef0010
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
cmp dword [ebp - 0x828], 0
je 0x4063c3
cmp dword [ebp - 0x830], 4
jne 0x4063c3
mov eax, dword [ebp - 0x828]
push dword [eax]
push dword [ebp + 8]
call fcn.004014e6
jmp 0x4063cd
push 0
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x820]
call fcn.00401835
push dword [ebp - 0x828]
call fcn.00401835
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x4061ec
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406454
Capabilities:
Gather ftp-explorer information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7cc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4066d6
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4064ac
jmp 0x4066ce
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401dc9
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x834]
push eax
push 0x41579e
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push 0x4157b4
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push str.Login
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x818], eax
push 0
push str.InitialPath
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x4157bf
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
or eax, eax
je 0x40657f
cmp dword [ebp - 0x828], 4
jne 0x40657f
push dword [eax]
pop dword [ebp - 0x824]
jmp 0x406589
mov dword [ebp - 0x824], 0x15
push eax
call fcn.00401835
lea eax, [ebp - 0x830]
push eax
push str.PasswordType
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
or eax, eax
je 0x4065c3
cmp dword [ebp - 0x830], 4
jne 0x4065c3
push dword [eax]
pop dword [ebp - 0x82c]
jmp 0x4065cd
mov dword [ebp - 0x82c], 0
push eax
call fcn.00401835
cmp dword [ebp - 0x81c], 0
je 0x40661b
cmp dword [ebp - 0x82c], 2
jne 0x40661b
push 0
lea eax, [ebp - 0x834]
push eax
push dword [ebp - 0x81c]
call fcn.004041a1
or eax, eax
je 0x406606
cmp dword [ebp - 0x834], 0
jne 0x40661b
push dword [ebp - 0x81c]
call fcn.00401835
mov dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
je 0x40668f
cmp dword [ebp - 0x814], 0
je 0x40668f
cmp dword [ebp - 0x818], 0
je 0x40668f
push 0xbeef0002
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x834]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040151c
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x820]
call fcn.00401835
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40647e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4068e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406aa4
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406938
jmp 0x406a9c
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push 0x41586e
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push 0x41585e
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push 0x415865
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FtpPort
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
or eax, eax
je 0x4069f4
cmp dword [ebp - 0x824], 4
jne 0x4069f4
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.00401835
jmp 0x406a08
or eax, eax
je 0x4069fe
push eax
call fcn.00401835
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406a68
cmp dword [ebp - 0x814], 0
je 0x406a68
cmp dword [ebp - 0x818], 0
je 0x406a68
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40690a
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406b14
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406d04
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406b6c
jmp 0x406cfc
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
lea eax, [ebp - 0x828]
push eax
push 0x4158c7
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push str.Hostname
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push str.Username
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push 0x4158d0
push dword [ebp - 0x810]
push dword [0x414841]
call fcn.00401cee
or eax, eax
je 0x406c2d
cmp dword [ebp - 0x824], 4
jne 0x406c2d
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.00401835
jmp 0x406c41
or eax, eax
je 0x406c37
push eax
call fcn.00401835
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406cc8
cmp dword [ebp - 0x814], 0
je 0x406cc8
cmp dword [ebp - 0x818], 0
je 0x406cc8
push 0
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x81c]
call fcn.004041a1
or eax, eax
je 0x406cc8
cmp dword [ebp - 0x828], 0
je 0x406cc8
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x828]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040151c
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x406b3e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406f41
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40711f
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406f96
jmp 0x407117
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push 0x41594f
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push str._Password
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x820], eax
push 0
push str.Server
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push 0x415946
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x818], eax
push 0
push str.Directory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x407057
cmp dword [ebp - 0x820], 0
je 0x4070bc
cmp dword [ebp - 0x814], 0
je 0x4070bc
cmp dword [ebp - 0x818], 0
je 0x4070bc
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x820]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x824]
call fcn.00401835
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406f41
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x406f68
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40716c
Capabilities:
Gather fling-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40734a
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4071c1
jmp 0x407342
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push str.FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push str._FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x820], eax
push 0
push str.FtpServer
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push str.FtpUserName
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x818], eax
push 0
push str.FtpDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x407282
cmp dword [ebp - 0x820], 0
je 0x4072e7
cmp dword [ebp - 0x814], 0
je 0x4072e7
cmp dword [ebp - 0x818], 0
je 0x4072e7
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x820]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x824]
call fcn.00401835
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040716c
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x407193
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407397
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407446
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x4073e9
jmp 0x40743e
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x810], eax
or eax, eax
je 0x40742e
cmp dword [ebp - 0x814], 0
je 0x40742e
push 0xbeef0000
push dword [ebp - 0x814]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00403ddc
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x4073be
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40755b
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401e2e
or eax, eax
je 0x407614
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x407588
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00401dc9
mov dword [ebp - 4], eax
push str.SharedSettings.ccs
push dword [ebp - 4]
call fcn.00401d75
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403e31
call fcn.00401835
push str.SharedSettings.sqlite
push dword [ebp - 4]
call fcn.00401d75
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403e31
call fcn.00401835
push str.SharedSettings_1_0_5.ccs
push dword [ebp - 4]
call fcn.00401d75
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403e31
call fcn.00401835
push str.SharedSettings_1_0_5.sqlite
push dword [ebp - 4]
call fcn.00401d75
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403e31
call fcn.00401835
push dword [ebp - 4]
call fcn.00401835
leave
ret 0xc