joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416e6e
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xbe4]
mov ebx, 0x3e8
push ebx
push eax
call fcn.00411f0d
pop ecx
pop ecx
test eax, eax
jne 0x416ebe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadSafariPasswordFromFile
push str._s_Plutil_file_does_not_exist__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x41706c
push edi
lea eax, [ebp - 0xbe4]
push eax
push str._n_Found_plutil_file__ready_to_convert_now__s
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x7fc]
mov edi, 0x208
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
cdq
mov ecx, 0x2710
idiv ecx
lea eax, [ebp - 0x7fc]
push edx
push eax
push str._stmp_xsprc_test__d.ini
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x20c]
push eax
push str._n_Output_xml_file_path___s
call fcn.00449974
push esi
lea eax, [ebp - 0x20c]
push eax
push str.xml1
push str._convert
lea eax, [ebp - 0xbe4]
push eax
push str.__s___s__s__s__o___s____s_
lea eax, [ebp - 0x5f4]
push ebx
push eax
call fcn.00445d6d
lea eax, [ebp - 0x5f4]
push eax
push str._n_Final_exe_file_path___s
call fcn.00449974
add esp, 0x44
lea eax, [ebp - 0xc38]
xor edi, edi
push 0x44
pop esi
push esi
push edi
push eax
call fcn.00626f50
add esp, 0xc
mov dword [ebp - 0xc38], esi
xor eax, eax
xor ebx, ebx
mov word [ebp - 0xc08], ax
inc ebx
lea eax, [ebp - 0xbf4]
mov dword [ebp - 0xc0c], ebx
push eax
lea eax, [ebp - 0xc38]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x5f4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x416fd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x5f4]
push eax
push str.LoadSafariPasswordFromFile
push str._n_s_:_Failed_to_launch_the_application__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x417037
lea eax, [ebp - 0x5f4]
mov edi, str.LoadSafariPasswordFromFile
push eax
push edi
push str._s_:_Successfully_create_the_process__s__waiting_for_it_to_terminate....
call fcn.00449974
add esp, 0xc
push 0xffffffffffffffff
push dword [ebp - 0xbf4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xbf0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xbf4]
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00449791
pop ecx
test eax, eax
jne 0x41703b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_Output_file_is_not_created__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x41706b
lea eax, [ebp - 0x20c]
push eax
push edi
push str._s_:_Successfully_created_the_output_file__s
call fcn.00449974
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00417740
add esp, 0x10
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x418805
Capabilities:
Get common file path
Get disk information
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x6733c8]
push ebx
push esi
push edi
push 5
pop ecx
mov word [ebp - 0x42c], ax
lea edi, [ebp - 0x18]
mov al, byte [0x6733ca]
mov esi, str.ftpprosconnect.ini
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x42a], al
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
push esi
push str.PerformAutoFTPProPasswordRecovery
push str._s_dwDriveMask0x_.8x
call fcn.00449974
add esp, 0xc
xor edi, edi
mov ebx, edi
xor eax, eax
mov ecx, ebx
inc eax
shl eax, cl
test esi, eax
je 0x4188d9
lea eax, [ebx + 0x41]
mov byte [ebp - 0x42c], al
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x4188d9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + 0x41]
push eax
push str._c:_s
lea eax, [ebp - 0x220]
push 0x208
push eax
call fcn.00445d6d
lea eax, [ebp - 0x220]
push eax
push str.PerformAutoFTPProPasswordRecovery
push str._n__s___Checking_in_drive___s
call fcn.00449974
lea eax, [ebp - 0x220]
push eax
call fcn.00449791
add esp, 0x24
test eax, eax
je 0x4188d9
lea eax, [ebp - 0x220]
push eax
call fcn.0041fe64
pop ecx
inc ebx
cmp ebx, 0x1a
jl 0x41885f
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x428]
push eax
push edi
push edi
push 0x1a
push edi
call esi
mov ebx, 0x66c218
test eax, eax
js 0x41894f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
lea eax, [ebp - 0x220]
push 0x208
push eax
call fcn.00445d6d
lea eax, [ebp - 0x220]
push eax
push str.PerformAutoFTPProPasswordRecovery
push str._n__s___Checking_in_appdata_folder__s
call fcn.00449974
lea eax, [ebp - 0x220]
push eax
call fcn.00449791
add esp, 0x24
test eax, eax
je 0x41894f
lea eax, [ebp - 0x220]
push eax
call fcn.0041fe64
pop ecx
lea eax, [ebp - 0x428]
push eax
push edi
push edi
push 0x1c
push edi
call esi
test eax, eax
js 0x4189b4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
lea eax, [ebp - 0x220]
push 0x208
push eax
call fcn.00445d6d
lea eax, [ebp - 0x220]
push eax
push str.PerformAutoFTPProPasswordRecovery
push str._n__s___Checking_in_local_appdata_folder__s
call fcn.00449974
lea eax, [ebp - 0x220]
push eax
call fcn.00449791
add esp, 0x24
test eax, eax
je 0x4189b4
lea eax, [ebp - 0x220]
push eax
call fcn.0041fe64
pop ecx
lea eax, [ebp - 0x428]
push eax
push edi
push edi
push 0x2a
push edi
call esi
test eax, eax
js 0x418a19
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
lea eax, [ebp - 0x220]
push 0x208
push eax
call fcn.00445d6d
lea eax, [ebp - 0x220]
push eax
push str.PerformAutoFTPProPasswordRecovery
push str._n__s___Checking_in_program_files___s
call fcn.00449974
lea eax, [ebp - 0x220]
push eax
call fcn.00449791
add esp, 0x24
test eax, eax
je 0x418a19
lea ecx, [ebp - 0x220]
push ecx
call fcn.0041fe64
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.005fe955
leave
ret
Function at 0x418a2b
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x970
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x217]
push 0x207
push ebx
push eax
mov byte [ebp - 0x218], bl
call fcn.00626f50
mov esi, str.UCBrowser
lea edi, [ebp - 0x10]
add esp, 0xc
lea eax, [ebp - 0x830]
movsd dword es:[edi], dword [esi]
push eax
push ebx
push ebx
movsd dword es:[edi], dword [esi]
push 0x1c
push ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x418a93
push str._n_Failed_to_get_current_users_local_appdata_folder
call fcn.00449974
pop ecx
xor eax, eax
jmp 0x418bae
lea eax, [ebp - 0x830]
mov edi, 0x208
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.006311ec
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00631246
lea eax, [ebp - 0x218]
mov ebx, str.PerformAutomaticUCPasswordRecovery
push eax
push ebx
push str._s_Final_UC_Browser_Root_path_is__s
call fcn.00449974
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00631246
lea eax, [ebp - 0x420]
push eax
push str._n_Searching_for_UC_Browser_profile_files_in_the_folder__s
call fcn.00449974
add esp, 0x44
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x418a8c
test byte [ebp - 0x970], 0x10
je 0x418b92
cmp byte [ebp - 0x944], 0x2e
je 0x418b92
lea eax, [ebp - 0x944]
push eax
push ebx
push str._s___Found_the_Directory___s
call fcn.00449974
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x218]
push eax
push str._s_sDefault
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x628]
push eax
push ebx
push str._s___Found_Profile_Folder...checking_for_UC_password_file__s
call fcn.00449974
lea eax, [ebp - 0x628]
push eax
call fcn.00410068
add esp, 0x30
lea eax, [ebp - 0x970]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418b2d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x418e3c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7dc
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x7dc]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwareFTPWareCoreFTPSites
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x418e8d
push eax
push str.PerformCoreFtpPasswordRecovery
push str._s_:_Failed_to_find_Core_FTP_Sitesin_registry__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x418f38
push esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7d8]
mov esi, ebx
push eax
lea eax, [ebp - 0x7d4]
push eax
push ebx
jmp 0x418efb
lea eax, [ebp - 0x7d4]
push eax
push str.SoftwareFTPWareCoreFTPSites_s
lea eax, [ebp - 0x3ec]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3ec]
push eax
push str.PerformCoreFtpPasswordRecovery
push str._s_:___Now_getting_details_for_the_Core_FTP_Sites_key__s
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
call fcn.00410fff
add esp, 0x20
lea eax, [ebp - 0x7d8]
inc esi
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x7d4]
push eax
push esi
push dword [ebp - 0x7dc]
mov dword [ebp - 0x7d8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x418ea5
push eax
push str.PerformCoreFtpPasswordRecovery
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x7dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x418f45
Capabilities:
Enumerate files on windows
Gather cuteftp information
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12ec
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 5
pop ecx
mov esi, str.GlobalscapeCuteFTP
lea edi, [ebp - 0xdc4]
rep movsd dword es:[edi], dword [esi]
push 0x3d4
xor esi, esi
lea eax, [ebp - 0xdb0]
push esi
push eax
call fcn.00626f50
mov edi, str.PerformCuteFTPPasswordRecovery
push edi
push str._n__s_Entered
call fcn.00449974
add esp, 0x14
lea eax, [ebp - 0x11ac]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x418fc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x4190f7
push ebx
lea eax, [ebp - 0xdc4]
mov ebx, 0x3e8
push eax
lea eax, [ebp - 0x11ac]
push eax
push 0x66c218
lea eax, [ebp - 0x5f4]
push ebx
push eax
call fcn.00445d6d
lea eax, [ebp - 0x5f4]
push eax
push edi
push str._s_Final_CuteFTP_profile_path_is__s
call fcn.00449974
lea eax, [ebp - 0x5f4]
mov esi, 0x208
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x20c]
push eax
push str._n_Searching_for_version_folder_sm.dat_files_in_the_folder__s
call fcn.00449974
add esp, 0x40
lea eax, [ebp - 0x12ec]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x419060
xor eax, eax
jmp 0x4190f6
test byte [ebp - 0x12ec], 0x10
je 0x4190d6
cmp byte [ebp - 0x12c0], 0x2e
je 0x4190d6
lea eax, [ebp - 0x12c0]
push eax
push edi
push str._s___Found_the_Directory___s
call fcn.00449974
lea eax, [ebp - 0x12c0]
push eax
lea eax, [ebp - 0x5f4]
push eax
push str._s_s_sm.dat
lea eax, [ebp - 0x9dc]
push ebx
push eax
call fcn.00445d6d
lea eax, [ebp - 0x9dc]
push eax
push edi
push str._s___Checking_for_password_file__s
call fcn.00449974
lea eax, [ebp - 0x9dc]
push eax
call fcn.00449791
add esp, 0x30
test eax, eax
je 0x4190d6
lea eax, [ebp - 0x9dc]
push eax
call fcn.00423ef0
pop ecx
lea eax, [ebp - 0x12ec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419060
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005fe955
leave
ret
Function at 0x419105
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x40c]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwareSpeedBitDownload_AcceleratorHostsData
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x419154
push eax
push str.PerformDAPPasswordRecovery
push str._s_:_Failed_to_find_DAP_stored_entries_in_registry__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x4191df
push esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x408]
mov esi, ebx
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
jmp 0x4191a5
lea eax, [ebp - 0x404]
push eax
push str.PerformDAPPasswordRecovery
push str._s_:_Found_site__s
call fcn.00449974
lea eax, [ebp - 0x404]
push eax
call fcn.0042490f
add esp, 0x10
lea eax, [ebp - 0x408]
inc esi
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x404]
push eax
push esi
push dword [ebp - 0x40c]
mov dword [ebp - 0x408], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x41916c
push eax
push str.PerformDAPPasswordRecovery
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x4191ec
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x60c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareAdobeCommon
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41923d
push eax
push str.PerformDreamweaverPasswordRecovery
push str._s_:_Failed_to_find_Dreamweaver_Sitesin_registry__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x419376
push ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x608]
mov dword [ebp - 0x608], 0x400
push eax
lea eax, [ebp - 0x604]
mov ebx, esi
push eax
push esi
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41934f
lea eax, [ebp - 0x604]
push eax
push str.PerformDreamweaverPasswordRecovery
push str._s_:_Found_site_entry__s
call fcn.00449974
lea eax, [ebp - 0x604]
push eax
push str.SoftwareAdobeCommon_sSites
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.00445d6d
lea eax, [ebp - 0x204]
push eax
push str.PerformDreamweaverPasswordRecovery
push str._s_:___Now_checking_for_Sites_key__s
call fcn.00449974
add esp, 0x28
lea eax, [ebp - 0x610]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x204]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419323
push dword [ebp - 0x610]
call esi
push 0x6767d4
call fcn.00631510
push eax
lea eax, [ebp - 0x604]
push 0x6767d4
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
lea eax, [ebp - 0x204]
push eax
jne 0x41931d
call fcn.004269e1
jmp 0x419322
call fcn.00426ad7
pop ecx
xor eax, eax
mov dword [ebp - 0x608], 0x400
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x608]
inc ebx
push eax
lea eax, [ebp - 0x604]
push eax
push ebx
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x419274
push eax
push str.PerformDreamweaverPasswordRecovery
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x60c]
call esi
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005fe955
leave
ret
Function at 0x419b1d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7f8
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x28]
push 8
pop ecx
mov esi, str.Free_Download_Manager_sites.sav
rep movsd dword es:[edi], dword [esi]
push ebx
movsb byte es:[edi], byte [esi]
call fcn.00631510
pop ecx
cmp eax, 1
jae 0x419b8a
lea eax, [ebp - 0x7f8]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x419b7a
push str._n_Failed_to_get_current_users_appdata_folder
call fcn.00449974
pop ecx
xor eax, eax
jmp 0x419c07
mov eax, 0x66ea84
lea ebx, [ebp - 0x7f8]
lea ecx, [ebp - 0x28]
jmp 0x419b94
mov eax, 0x66c218
mov ecx, str.sites.sav
push ecx
push ebx
push eax
lea eax, [ebp - 0x410]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x410]
mov esi, str.PerformFDMPasswordRecoveryOld
push eax
push esi
push str._s_Final_FDM_password_file__s
call fcn.00449974
lea eax, [ebp - 0x410]
push eax
call fcn.00449791
add esp, 0x24
test eax, eax
lea eax, [ebp - 0x410]
push eax
jne 0x419be9
push esi
push str._s__FDM_password_file__s_does_not_exist
call fcn.00449974
add esp, 0xc
jmp 0x419b73
call fcn.00409be9
pop ecx
test eax, eax
jne 0x419c04
push esi
push str._s_Could_not_find_any_saved_passwords_by_Free_Download_Manager.
call fcn.00449974
pop ecx
jmp 0x419b72
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x419c16
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7fc
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x413]
xor ebx, ebx
push 0x207
push ebx
push eax
mov byte [ebp - 0x414], bl
call fcn.00626f50
push 0x26
pop esi
push edi
call fcn.00631510
add esp, 0x10
test eax, eax
je 0x419c92
push edi
push str._s_ftplist.txt
lea eax, [ebp - 0x7fc]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x7fc]
push eax
call fcn.00449791
add esp, 0x14
test eax, eax
je 0x419dca
lea eax, [ebp - 0x7fc]
jmp 0x419dc3
cmp dword [0x716864], ebx
push 0x2a
pop eax
cmovne esi, eax
lea eax, [ebp - 0x414]
push eax
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x419cd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.PerformFTPCommanderPasswordRecovery
push str._s_Failed_to_find_Program_files_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x419dcd
lea eax, [ebp - 0x414]
mov esi, str.PerformFTPCommanderPasswordRecovery
push eax
push esi
push str._s___Program_files__path___s
call fcn.00449974
lea eax, [ebp - 0x414]
mov edi, 0x208
push eax
push str._sFTP_Commander_Deluxe_ftplist.txt
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x20c]
mov ebx, str._s___Testing_profile_path___s
push eax
push esi
push ebx
call fcn.00449974
lea eax, [ebp - 0x20c]
push eax
call fcn.00449791
add esp, 0x2c
test eax, eax
je 0x419d3b
lea eax, [ebp - 0x20c]
push eax
call fcn.0042876e
pop ecx
movsx eax, byte [ebp - 0x414]
push eax
push str._c:cftp_ftplist.txt
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call fcn.00449974
lea eax, [ebp - 0x20c]
push eax
call fcn.00449791
add esp, 0x20
test eax, eax
je 0x419d83
lea eax, [ebp - 0x20c]
push eax
call fcn.0042876e
pop ecx
lea eax, [ebp - 0x414]
push eax
push str._sFTP_Commander_ftplist.txt
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call fcn.00449974
lea eax, [ebp - 0x20c]
push eax
call fcn.00449791
add esp, 0x20
test eax, eax
je 0x419dca
lea eax, [ebp - 0x20c]
push eax
call fcn.0042876e
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x419df2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbe4
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x413]
push esi
push edi
mov esi, 0x3e7
mov byte [ebp - 0x414], 0
push esi
push 0
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x7fb]
mov byte [ebp - 0x7fc], 0
push 0
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0xbe3]
mov byte [ebp - 0xbe4], 0
push 0
push eax
call fcn.00626f50
mov esi, str._recentservers.xml
lea edi, [ebp - 0x2c]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str._sitemanager.xml
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00631510
add esp, 0x28
cmp eax, 1
jae 0x419ee8
lea eax, [ebp - 0xbe4]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x419eb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.PerformFilezillaPasswordRecovery
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x419fc2
lea eax, [ebp - 0xbe4]
push eax
push str._n_User_app_data_directory___s
call fcn.00449974
lea eax, [ebp - 0xbe4]
mov esi, 0x3e8
push eax
push str._sFileZilla
lea eax, [ebp - 0x7fc]
push esi
push eax
call fcn.00445d6d
add esp, 0x18
jmp 0x419efe
push ebx
mov esi, 0x3e8
lea eax, [ebp - 0x7fc]
push esi
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x7fc]
push eax
push str._n_Final_profile_path___s
call fcn.00449974
lea eax, [ebp - 0x7fc]
push eax
call fcn.0044975e
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x7fc]
push eax
jne 0x419f38
push str.PerformFilezillaPasswordRecovery
push str._s_FileZilla_Profile_path__s_does_not_exist
jmp 0x419ea5
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x414]
mov ebx, str.PerformFilezillaPasswordRecovery
push eax
push ebx
mov edi, str._s_Final_filezilla_pass_path_is__s
push edi
call fcn.00449974
lea eax, [ebp - 0x414]
push eax
call fcn.00429c35
lea eax, [ebp - 0x7fc]
push eax
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00631246
add esp, 0x40
lea ecx, [ebp - 0x414]
push ecx
push ebx
push edi
call fcn.00449974
lea ecx, [ebp - 0x414]
push ecx
call fcn.00429c35
xor eax, eax
add esp, 0x10
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret