joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4057c0
Capabilities:
Gather filezilla information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push 0xbeef0013
push str.Server_Type
push 0x415cfb
push 0x415cf6
push 0x415cec
push 0x415ce7
push 0x415cf1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405660
push 0xbeef0013
push 0x415d47
push 0x415d42
push str.Server.Port
push str.Server.User
push str.Server.Host
push str.Server.Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405660
push 0xbeef0014
push str.Last_Server_Type
push str.Last_Server_Path
push str.Last_Server_Port
push str.Last_Server_User
push str.Last_Server_Host
push str.Last_Server_Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405660
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x4150da]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4058e3
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40589b
jmp 0x4058db
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d40
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004057c0
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x405870
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x405d76
Capabilities:
Gather ffftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x4150da]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x405f71
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x405dce
jmp 0x405f69
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0x415fad
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push str.HostAdrs
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push 0x415fb6
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDir
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x415fd2
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
and eax, eax
je 0x405ea8
cmp dword [ebp - 0x828], 4
jne 0x405ea8
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.00401871
jmp 0x405ebc
and eax, eax
je 0x405eb2
push eax
call fcn.00401871
mov dword [ebp - 0x824], 0x15
cmp dword [ebp - 0x81c], 0
je 0x405f2a
cmp dword [ebp - 0x814], 0
je 0x405f2a
cmp dword [ebp - 0x818], 0
je 0x405f2a
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x405da0
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40600e
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x4150da]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4061f2
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x406066
jmp 0x4061ea
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0x415fee
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push 0x415fd7
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push 0x415fe0
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x820], eax
push 0
push 0x415fe5
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x818], eax
push 0
push str.HostDirName
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
je 0x406192
cmp dword [ebp - 0x814], 0
je 0x406192
cmp dword [ebp - 0x818], 0
je 0x406192
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040600e
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x406038
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406227
Capabilities:
Gather coreftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x4150da]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x406484
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40627f
jmp 0x40647c
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d40
mov dword [ebp - 0x810], eax
push 0
push 0x41605f
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push 0x416050
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push 0x416055
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x818], eax
push 0
push str.PthR
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x82c]
push eax
push 0x41605a
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
and eax, eax
je 0x406353
cmp dword [ebp - 0x82c], 4
jne 0x406353
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.00401871
jmp 0x406367
and eax, eax
je 0x40635d
push eax
call fcn.00401871
mov dword [ebp - 0x824], 0x15
lea eax, [ebp - 0x830]
push eax
push 0x416067
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x81c], 0
je 0x406432
cmp dword [ebp - 0x814], 0
je 0x406432
cmp dword [ebp - 0x818], 0
je 0x406432
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401584
cmp dword [ebp - 0x828], 0
je 0x406428
cmp dword [ebp - 0x830], 4
jne 0x406428
mov eax, dword [ebp - 0x828]
push dword [eax]
push dword [ebp + 8]
call fcn.00401522
jmp 0x406432
push 0
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
push dword [ebp - 0x828]
call fcn.00401871
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x406251
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4064b9
Capabilities:
Gather ftp-explorer information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7cc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x4150da]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x40673b
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x406511
jmp 0x406733
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d40
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x834]
push eax
push 0x4160e9
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push 0x4160ff
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push str.Login
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x818], eax
push 0
push str.InitialPath
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x41610a
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
and eax, eax
je 0x4065e4
cmp dword [ebp - 0x828], 4
jne 0x4065e4
push dword [eax]
pop dword [ebp - 0x824]
jmp 0x4065ee
mov dword [ebp - 0x824], 0x15
push eax
call fcn.00401871
lea eax, [ebp - 0x830]
push eax
push str.PasswordType
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
and eax, eax
je 0x406628
cmp dword [ebp - 0x830], 4
jne 0x406628
push dword [eax]
pop dword [ebp - 0x82c]
jmp 0x406632
mov dword [ebp - 0x82c], 0
push eax
call fcn.00401871
cmp dword [ebp - 0x81c], 0
je 0x406680
cmp dword [ebp - 0x82c], 2
jne 0x406680
push 0
lea eax, [ebp - 0x834]
push eax
push dword [ebp - 0x81c]
call fcn.004041ba
and eax, eax
je 0x40666b
cmp dword [ebp - 0x834], 0
jne 0x406680
push dword [ebp - 0x81c]
call fcn.00401871
mov dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
je 0x4066f4
cmp dword [ebp - 0x814], 0
je 0x4066f4
cmp dword [ebp - 0x818], 0
je 0x4066f4
push 0xbeef0002
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x834]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401558
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x4064e3
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406945
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x4150da]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x406b09
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x40699d
jmp 0x406b01
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0x4161b9
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push 0x4161a9
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push 0x4161b0
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FtpPort
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
and eax, eax
je 0x406a59
cmp dword [ebp - 0x824], 4
jne 0x406a59
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.00401871
jmp 0x406a6d
and eax, eax
je 0x406a63
push eax
call fcn.00401871
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406acd
cmp dword [ebp - 0x814], 0
je 0x406acd
cmp dword [ebp - 0x818], 0
je 0x406acd
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x40696f
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406b79
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x4150da]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x406d69
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x406bd1
jmp 0x406d61
push 0x4150b6
push dword [ebp + 0xc]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
lea eax, [ebp - 0x828]
push eax
push 0x416212
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push str.Hostname
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push str.Username
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push 0x41621b
push dword [ebp - 0x810]
push dword [0x4150da]
call fcn.00401c65
and eax, eax
je 0x406c92
cmp dword [ebp - 0x824], 4
jne 0x406c92
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.00401871
jmp 0x406ca6
and eax, eax
je 0x406c9c
push eax
call fcn.00401871
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406d2d
cmp dword [ebp - 0x814], 0
je 0x406d2d
cmp dword [ebp - 0x818], 0
je 0x406d2d
push 0
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x81c]
call fcn.004041ba
and eax, eax
je 0x406d2d
cmp dword [ebp - 0x828], 0
je 0x406d2d
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x828]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401558
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x406ba3
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406fa6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x407184
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x406ffb
jmp 0x40717c
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0x41629a
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push str._Password
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x820], eax
push 0
push str.Server
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push 0x416291
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x818], eax
push 0
push str.Directory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x4070bc
cmp dword [ebp - 0x820], 0
je 0x407121
cmp dword [ebp - 0x814], 0
je 0x407121
cmp dword [ebp - 0x818], 0
je 0x407121
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406fa6
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x406fcd
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x4071d1
Capabilities:
Gather fling-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4073af
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x407226
jmp 0x4073a7
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push str.FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x81c], eax
push 0
push str._FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x820], eax
push 0
push str.FtpServer
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push str.FtpUserName
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x818], eax
push 0
push str.FtpDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x4072e7
cmp dword [ebp - 0x820], 0
je 0x40734c
cmp dword [ebp - 0x814], 0
je 0x40734c
cmp dword [ebp - 0x818], 0
je 0x40734c
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - 0x81c]
call fcn.00401871
push dword [ebp - 0x820]
call fcn.00401871
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x824]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004071d1
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x4071f8
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x4073fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4074ab
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
and eax, eax
je 0x40744e
jmp 0x4074a3
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x810], eax
and eax, eax
je 0x407493
cmp dword [ebp - 0x814], 0
je 0x407493
push 0xbeef0000
push dword [ebp - 0x814]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00403df5
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x407423
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x4075c0
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401da5
and eax, eax
je 0x407679
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x4075ed
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00401d40
mov dword [ebp - 4], eax
push str.SharedSettings.ccs
push dword [ebp - 4]
call fcn.00401cec
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403e4a
call fcn.00401871
push str.SharedSettings.sqlite
push dword [ebp - 4]
call fcn.00401cec
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403e4a
call fcn.00401871
push str.SharedSettings_1_0_5.ccs
push dword [ebp - 4]
call fcn.00401cec
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403e4a
call fcn.00401871
push str.SharedSettings_1_0_5.sqlite
push dword [ebp - 4]
call fcn.00401cec
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403e4a
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
leave
ret 0xc
Function at 0x4076f2
Capabilities:
Gather leapftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x407859
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x407747
jmp 0x407851
push 0x4150b6
push dword [ebp + 0x10]
call fcn.00401cec
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cec
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push str.InstallPath
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x814], eax
push 0
push 0x41647f
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c65
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 0
je 0x4077de
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.0040412f
push 0xbeef0001
push 0x416445
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.0040412f
cmp dword [ebp - 0x818], 0
je 0x407817
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040412f
push 0xbeef0001
push 0x416445
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040412f
push dword [ebp - 0x814]
call fcn.00401871
push dword [ebp - 0x818]
call fcn.00401871
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004076f2
push dword [ebp - 0x810]
call fcn.00401871
inc dword [ebp - 8]
jmp 0x407719
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc