joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409832
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0x14]
or eax, eax
je 0x409851
cmp byte [eax], 0
jne 0x409856
jmp 0x409a9a
push dword [ebp + 0x14]
call fcn.004025a9
or eax, eax
jne 0x409871
push str..
push dword [ebp + 0x14]
call fcn.00401df8
jmp 0x40987e
push 0x414f8e
push dword [ebp + 0x14]
call fcn.00401df8
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x409a9a
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x409949
lea eax, [edx + 0x2c]
push eax
push 0x414f84
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x4098dd
jmp 0x409a75
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414f86
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x4098fa
jmp 0x409a75
push dword [ebp + 0x14]
call fcn.004025a9
or eax, eax
jne 0x409915
push 0x414845
push dword [ebp + 0x14]
call fcn.00401df8
jmp 0x40991f
push 0
push dword [ebp + 0x14]
call fcn.00401df8
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e4c
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409832
call fcn.004018b8
jmp 0x409a75
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [0x416030], 3
jne 0x4099a1
push str.prefs.js
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x40999c
push 0x414845
push dword [ebp + 0x14]
call fcn.00401df8
push dword [ebp - 0x14c]
push eax
call fcn.00401e4c
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.0040406c
call fcn.004018b8
jmp 0x409a75
push str.signons.sqlite
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4099e3
push 0x414845
push dword [ebp + 0x14]
call fcn.00401df8
push dword [ebp - 0x14c]
push eax
call fcn.00401e4c
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0040926b
call fcn.004018b8
push dword [ebp - 0x14c]
call sub.KERNEL32.DLL_lstrlenA
cmp eax, 2
jb 0x409a07
mov edx, dword [ebp - 0x14c]
add edx, eax
sub edx, 2
cmp word [edx], 0x732e
jne 0x409a07
jmp 0x409a47
push str.signons.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons2.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
push eax
push str.signons3.txt
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
pop edx
pop ecx
or eax, eax
jne 0x409a47
or edx, edx
jne 0x409a47
or ecx, ecx
je 0x409a75
push 0x414845
push dword [ebp + 0x14]
call fcn.00401df8
push dword [ebp - 0x14c]
push eax
call fcn.00401e4c
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004094d8
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4098b4
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 0x10
Function at 0x409ac1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push dword [ebp + 0xc]
call fcn.00401f7e
or eax, eax
jne 0x409ad9
pop edi
leave
ret 0xc
push dword [ebp + 0x10]
call fcn.00401f7e
or eax, eax
jne 0x409aea
pop edi
leave
ret 0xc
push dword [ebp + 0xc]
call fcn.004025a9
or eax, eax
jne 0x409b05
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
jmp 0x409b0f
push 0
push dword [ebp + 0xc]
call fcn.00401df8
mov dword [ebp - 0xc], eax
push str.profiles.ini
push dword [ebp - 0xc]
call fcn.00401df8
mov dword [ebp - 8], eax
push 0xfdea
call fcn.004018cf
mov dword [ebp - 4], eax
push 0x1000
call fcn.004018cf
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
call fcn.00401f36
or eax, eax
je 0x409c09
push dword [ebp - 8]
push 0xfde8
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetPrivateProfileSectionNamesA
cmp eax, 2
jbe 0x409c09
mov edi, dword [ebp - 4]
cmp byte [edi], 0
je 0x409c09
push str.Profile
push edi
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x409bf7
push dword [ebp - 8]
push 0xfff
push dword [ebp - 0x10]
push 0x414847
push 0x416058
push edi
call sub.KERNEL32.DLL_GetPrivateProfileStringA
or eax, eax
je 0x409bf7
push dword [ebp - 8]
push 1
push str.IsRelative
push edi
call sub.KERNEL32.DLL_GetPrivateProfileIntA
cmp eax, 1
jne 0x409be9
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00401df8
push eax
mov edx, eax
jmp 0x409bcd
cmp byte [edx], 0x2f
jne 0x409bcc
mov byte [edx], 0x5c
inc edx
or edx, edx
je 0x409bd6
cmp byte [edx], 0
jne 0x409bc4
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00409aa9
call fcn.004018b8
jmp 0x409bf7
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.00409aa9
cld
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne 0x409b71
push dword [ebp - 0xc]
call fcn.004018b8
push dword [ebp - 0x10]
call fcn.004018b8
push dword [ebp - 8]
call fcn.004018b8
push dword [ebp - 4]
call fcn.004018b8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409aa9
pop edi
leave
ret 0xc
Function at 0x409c3c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x409ca8
push 0
push str.PathToExe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401d71
or eax, eax
je 0x409ca8
push eax
push eax
call fcn.0040242b
or eax, eax
je 0x409ca3
mov dword [ebp - 0x18], eax
push 0x1a
call fcn.00401eb1
or eax, eax
je 0x409c9b
push dword [ebp + 0x18]
push eax
call fcn.00401e4c
push eax
push dword [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00409ac1
call fcn.004018b8
push dword [ebp - 0x18]
call fcn.004018b8
call fcn.004018b8
push 0x800
call fcn.004018cf
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x409d38
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x409cf6
jmp 0x409d30
push 0x414845
push dword [ebp + 0x10]
call fcn.00401df8
push dword [ebp - 8]
push eax
call fcn.00401e4c
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409c3c
push dword [ebp - 0x14]
call fcn.004018b8
inc dword [ebp - 0x10]
jmp 0x409ccf
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 8]
call fcn.004018b8
leave
ret 0x14

Function at 0x40aed7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40b00e
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40af2f
jmp 0x40b006
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x818], eax
call fcn.004018b8
lea eax, [ebp - 0x10]
push eax
push str.SiteServers
push dword [ebp - 0x818]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40afda
cmp dword [ebp - 0x10], 4
jne 0x40afcf
mov eax, dword [ebp - 0x814]
push dword [eax]
pop dword [ebp - 0x814]
cmp dword [ebp - 0x814], 0x3e8
jbe 0x40afaa
mov dword [ebp - 0x814], 0x3e8
jmp 0x40afc6
dec dword [ebp - 0x814]
push dword [ebp - 0x814]
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040ac3e
cmp dword [ebp - 0x814], 0
jne 0x40afac
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040aed7
push dword [ebp - 0x818]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40af01
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40d072
Capabilities:
Gather robo-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40d2c7
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40d0c7
jmp 0x40d2bf
push 0x414845
push dword [ebp + 0x10]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x814], eax
call fcn.004018b8
lea eax, [ebp - 0xc]
push eax
push 0x416817
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x828], eax
push 0
push str.ServerName
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x818], eax
push 0
push 0x41682b
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x82c]
push eax
push 0x416843
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d71
or eax, eax
je 0x40d179
cmp dword [ebp - 0x82c], 4
jne 0x40d179
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004018b8
jmp 0x40d18d
or eax, eax
je 0x40d183
push eax
call fcn.004018b8
mov dword [ebp - 0x820], 0x15
push 0
push str.InitialDirectory
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x824], eax
push 0
push str.ServerType
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x828], 0
je 0x40d264
push 0x416859
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x828]
call fcn.004043dc
or eax, eax
je 0x40d264
cmp dword [ebp - 0xc], 0
je 0x40d264
cmp dword [ebp - 0x81c], 0
je 0x40d264
cmp dword [ebp - 0x818], 0
je 0x40d264
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0xc]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040159f
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x830]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x828]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x830]
call fcn.004018b8
push dword [ebp - 0x814]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d072
push dword [ebp - 0x814]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40d099
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40d2cb
Capabilities:
Gather robo-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push str.FTP_Count
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401d71
or eax, eax
je 0x40d356
push eax
cmp dword [ebp - 4], 4
jne 0x40d351
push dword [eax]
pop dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jbe 0x40d307
mov dword [ebp - 8], 0x1f4
jmp 0x40d34b
push dword [ebp - 8]
push str.FTP_File_d
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401d71
or eax, eax
je 0x40d348
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.0040406c
call fcn.004018b8
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x40d309
call fcn.004018b8
leave
ret 8

Function at 0x40d5c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40d792
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40d618
jmp 0x40d78a
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x824], eax
call fcn.004018b8
push 0
push str.Host
push dword [ebp - 0x824]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x810], eax
push 0
push str.User
push dword [ebp - 0x824]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push str.Pass
push dword [ebp - 0x824]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x818], eax
push 0
push 0x4168b9
push dword [ebp - 0x824]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push str.Remote_Dir
push dword [ebp - 0x824]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x814], 0
je 0x40d732
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.0040d5c0
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40d5ea
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40d9fa
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40dbda
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40da4f
jmp 0x40dbd2
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x828], eax
call fcn.004018b8
push 0
push str.HostName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x810], eax
push 0
push str.UserName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push str.Password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.PortNumber
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push str.TerminalType
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x810], 0
je 0x40db77
cmp dword [ebp - 0x814], 0
je 0x40db77
cmp dword [ebp - 0x818], 0
je 0x40db77
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.00401569
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.0040159f
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040d9fa
push dword [ebp - 0x828]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40da21
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40dc62
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40de97
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40dcb7
jmp 0x40de8f
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x828], eax
call fcn.004018b8
push 0
push str.FTP_destination_server
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x810], eax
push 0
push str.FTP_destination_user
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push str.FTP_destination_password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FTP_destination_port
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push str.FTP_destination_catalog
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x830]
push eax
push str.FTP_profiles
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x810], 0
je 0x40ddff
cmp dword [ebp - 0x814], 0
je 0x40ddff
cmp dword [ebp - 0x818], 0
je 0x40ddff
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.00401569
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.0040159f
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.004015cb
cmp dword [ebp - 0x830], 0
je 0x40de29
push 0xbeef0001
push dword [ebp + 0x10]
call fcn.00401569
push dword [ebp - 0x830]
push dword [ebp - 0x82c]
push dword [ebp + 0x10]
call fcn.0040159f
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040dc62
push dword [ebp - 0x828]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x82c]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40dc89
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40e237
Capabilities:
Gather winzip information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40e37c
push 0
push str.Site
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 8], eax
push 0
push str.UserID
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
push str.xflags
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x10], eax
push 0
push str.Port
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x14], eax
push 0
push str.Folder
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
je 0x40e34c
cmp dword [ebp - 0x1c], 0
je 0x40e34c
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.00402b0d
or eax, eax
je 0x40e34c
shr dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.004043dc
or eax, eax
je 0x40e34c
cmp dword [ebp - 8], 0
je 0x40e34c
cmp dword [ebp - 0xc], 0
je 0x40e34c
cmp dword [ebp - 0x10], 0
je 0x40e34c
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.00401569
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.0040159f
push dword [ebp - 0x14]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp - 0x18]
push dword [ebp + 0x10]
call fcn.004015cb
push dword [ebp - 8]
call fcn.004018b8
push dword [ebp - 0xc]
call fcn.004018b8
push dword [ebp - 0x10]
call fcn.004018b8
push dword [ebp - 0x14]
call fcn.004018b8
push dword [ebp - 0x18]
call fcn.004018b8
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40e380
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40e445
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x40e3d7
jmp 0x40e43d
cmp dword [ebp - 0x814], 1
je 0x40e3e5
inc dword [ebp - 8]
jmp 0x40e3a7
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d71
or eax, eax
je 0x40e435
mov dword [ebp - 0x810], eax
push str..wjf
push dword [ebp - 0x810]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x40e42a
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.0040e0fe
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40e3a7
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40e9f9
Capabilities:
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
push 0x105
call fcn.004018cf
mov dword [ebp - 0x818], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40eb34
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40ea5e
jmp 0x40eb2c
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push str.Path
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00401d71
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40eafd
push str.PocoSystem.ini
push dword [ebp - 0x814]
call fcn.00401df8
push eax
push eax
push 0x104
push dword [ebp - 0x818]
push 0x414847
push str.DataPath
push str.Program
call sub.KERNEL32.DLL_GetPrivateProfileStringA
cmp eax, 3
jbe 0x40eaf8
push 0xbeef0000
push str.accounts.ini
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00404351
call fcn.004018b8
push dword [ebp + 0x10]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040e9f9
push dword [ebp - 0x810]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40ea30
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 0x818]
call fcn.004018b8
leave
ret 0xc