joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4111df
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x411200
push str._n_Failed_to_get_fixed_drive
call fcn.00449974
pop ecx
xor eax, eax
leave
ret
xor ecx, ecx
lea eax, [ebp - 4]
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x411234
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetDriveSerial
push str._s___GetVolumeInformation_failed__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x4111fc
push dword [ebp - 4]
push str._08X
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00445d6d
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.GetDriveSerial
push str._s___Serial_for_Drive__s_is__s
call fcn.00449974
xor eax, eax
add esp, 0x20
inc eax
leave
ret

Function at 0x411264
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3eb]
xor ebx, ebx
push 0x3e7
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.00626f50
add esp, 0xc
mov byte [esi], bl
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFTP_Navigator_is1
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4112d6
push eax
push str.GetFTPNavigatorInstallPath
push str._s_:_Failed_to_open_the_install_location__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x411382
push edi
lea eax, [ebp - 0x3f4]
mov edi, 0x3e8
push eax
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x3f4], edi
push eax
lea eax, [ebp - 0x3f8]
push eax
push ebx
push str.InstallLocation
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp eax, 1
jae 0x41132b
xor eax, eax
jmp 0x411381
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp byte [ebp + eax - 0x3ed], 0x5c
jne 0x41135b
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
dec eax
pop ecx
cmp eax, edi
jae 0x411390
mov byte [ebp + eax - 0x3ec], bl
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp + 0xc]
push esi
call fcn.006311ec
push esi
push str.GetFTPNavigatorInstallPath
push str._s_:_Found_in_registry_FTP_Navigator_install_location_is
call fcn.00449974
xor eax, eax
add esp, 0x18
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3
Function at 0x41139a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3eb]
xor ebx, ebx
push 0x3e7
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.00626f50
add esp, 0xc
mov byte [esi], bl
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push ebx
push str.SoftwareAerofoxFoxmailPreview
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41140c
push eax
push str.GetFoxmailInstallPath
push str._s_:_Failed_to_open_the_install_location__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x4114b2
push edi
lea eax, [ebp - 0x3f4]
mov dword [ebp - 0x3f4], 0x3e8
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3f8]
push eax
push ebx
push str.Executable
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3ec]
mov edi, str.GetFoxmailInstallPath
push eax
push edi
push str._s_:_Found_Executable_path__s
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
add esp, 0x10
cmp eax, 1
jae 0x411479
xor eax, eax
jmp 0x4114b1
lea eax, [ebp - 0x3ec]
push 0x5c
push eax
call fcn.006271e0
pop ecx
pop ecx
test eax, eax
je 0x41148f
mov byte [eax], bl
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp + 0xc]
push esi
call fcn.006311ec
push esi
push edi
push str._s_:_Final_Foxmail_install_location_is__s
call fcn.00449974
xor eax, eax
add esp, 0x18
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x411966
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x22b]
push esi
push edi
push 0x207
push 0
push eax
mov byte [ebp - 0x22c], 0
call fcn.00626f50
add esp, 0xc
lea edi, [ebp - 0x24]
mov esi, str.Opera_MailOpera_Mailwand.dat
lea eax, [ebp - 0x22c]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push eax
xor eax, eax
push eax
push eax
movsw word es:[edi], word [esi]
push 0x1a
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x4119df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetOperaWandFilePath
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x411a5e
lea eax, [ebp - 0x22c]
push eax
push str._n_User_app_data_directory___s
call fcn.00449974
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0x66c218
lea eax, [ebp - 0x434]
push 0x208
push eax
call fcn.00445d6d
lea eax, [ebp - 0x434]
push eax
call fcn.00449791
add esp, 0x20
test eax, eax
lea eax, [ebp - 0x434]
push eax
je 0x411a52
push str.GetOperaWandFilePath
push str._s__Found_Opera_Mail_Wand_File_location__s
call fcn.00449974
lea eax, [ebp - 0x434]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.006311ec
xor eax, eax
add esp, 0x18
inc eax
jmp 0x411a60
push str.Wand_File_location_not_found__Opera_Mail_may_not_have_installed
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret

Function at 0x411a75
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.SoftwarePaltalk
push SysReAllocString
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x411ad2
push eax
push str.GetPaltalkInstallRootPath
push str._s_:_Failed_to_open_the_Paltalk_registry_account_key__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x411b53
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.InstallerAppDir
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x411b24
push esi
push str.GetPaltalkInstallRootPath
push str._s_:_RegQueryValueEx_failed_to_read_the_InstallerAppDir___Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x411b52
lea eax, [ebp - 0x20c]
push eax
push str.GetPaltalkInstallRootPath
push str._s_:_RegQueryValueEx_read_the_value_for_InstallerAppDir___s
call fcn.00449974
push 3
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00631360
xor eax, eax
add esp, 0x1c
inc eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.005fe955
leave
ret
Function at 0x411b60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov edi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x411bb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetParentProcessName
push str._s_:_CreateToolhelp32Snapshot_Failed___Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x411cd4
push 0x128
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.00626f50
add esp, 0xc
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x411bf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetParentProcessName
push str._s_:_Process32First_Failed___Error0x_.8x
jmp 0x411ba2
cmp dword [ebp - 0x124], edi
je 0x411c10
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x411bf5
jmp 0x411baa
mov edi, dword [ebp - 0x114]
push edi
push str.GetParentProcessName
push str._s_:_Found_Parent_Process_ID__d
call fcn.00449974
add esp, 0xc
test edi, edi
je 0x411baa
push 0x128
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.00626f50
add esp, 0xc
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x411c74
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, str.GetParentProcessName
push esi
jmp 0x411bee
cmp dword [ebp - 0x124], edi
je 0x411c99
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x411c74
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x411baa
lea eax, [ebp - 0x108]
mov esi, str.GetParentProcessName
push eax
push edi
push esi
push str._s_:_Found_Parent_Process_Path__d____s
call fcn.00449974
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.006311ec
push ebx
push edi
push esi
push str._s_:_Final_Parent_Process_name_is___d____s
call fcn.00449974
xor eax, eax
add esp, 0x2c
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x411ce3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2714
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2713]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x270f
push ebx
push eax
mov byte [ebp - 0x2714], bl
call fcn.00626f50
add esp, 0xc
mov byte [edi], bl
lea eax, [ebp - 0x2714]
mov byte [esi], bl
push eax
push ebx
push ebx
push 0x1a
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call ebx
test eax, eax
jns 0x411d5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetPhonebookLocations
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x411e0c
lea eax, [ebp - 0x2714]
push eax
push str._sMicrosoftNetworkConnectionspbk_rasphone.pbk
push dword [ebp + 0x10]
push edi
call fcn.00445d6d
push edi
push str.GetPhonebookLocations
push str._n_s_Current_user_phonebook__s
call fcn.00449974
push edi
call fcn.00449791
add esp, 0x20
test eax, eax
jne 0x411da4
push edi
mov edi, str.GetPhonebookLocations
push edi
push str._n_s__Current_user_phone_book_file_not_found___s
call fcn.00449974
add esp, 0xc
jmp 0x411da9
mov edi, str.GetPhonebookLocations
lea eax, [ebp - 0x2714]
push eax
xor eax, eax
push eax
push eax
push 0x23
push eax
call ebx
test eax, eax
jns 0x411dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_Failed_to_find_all_users_appdata_folder__Error0x_.8x
jmp 0x411d4d
lea eax, [ebp - 0x2714]
push eax
push str._sMicrosoftNetworkConnectionspbk_rasphone.pbk
push dword [ebp + 0x10]
push esi
call fcn.00445d6d
push esi
push edi
push str._n_s_All_users_phonebook__s
call fcn.00449974
push esi
call fcn.00449791
add esp, 0x20
test eax, eax
jne 0x411e09
push esi
push edi
push str._n_s__All_user_phone_book_file_not_found___s
call fcn.00449974
add esp, 0xc
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x411e1b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3eb]
xor ebx, ebx
push 0x3e7
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.00626f50
add esp, 0xc
mov byte [esi], bl
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push ebx
push str.SoftwareACSPuTTY_Connection_Manager
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x411e8a
push eax
push str.GetPuttyCMDatabasePath
push str._s_:_Failed_to_open_the_database_location__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x411eff
lea eax, [ebp - 0x3f4]
mov dword [ebp - 0x3f4], 0x3e8
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3f8]
push eax
push ebx
push str.DefaultDatabase
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp eax, 1
jb 0x411e86
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp + 0xc]
push esi
call fcn.006311ec
push esi
push str.GetPuttyCMDatabasePath
push str._s_:_Final_PuttyCM_database_path_is__s
call fcn.00449974
xor eax, eax
add esp, 0x18
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x411f0d
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ec
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3eb]
xor ebx, ebx
push 0x3e7
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.00626f50
add esp, 0xc
lea eax, [ebp - 0x3ec]
push eax
push ebx
push ebx
push 0x2a
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call ebx
test eax, eax
jns 0x411f75
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSafariPlutilPath
push str._s_Failed_to_find_programfiles86_folder_Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x411fb7
push str.plutil
push str.upport
push str.pplication_S
push str.Apple_A
lea eax, [ebp - 0x3ec]
push eax
push str._sSafari_s_s_s_s.exe
push dword [ebp + 0xc]
push esi
call fcn.00445d6d
push esi
push str._n_Final_plutil_path___s
call fcn.00449974
push esi
call fcn.00449791
add esp, 0x2c
cmp eax, 1
je 0x41202d
lea eax, [ebp - 0x3ec]
push eax
xor eax, eax
push eax
push eax
push 0x2c
push eax
call ebx
test eax, eax
jns 0x411fe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSafariPlutilPath
push str._s_Failed_to_find_commonfilesx86_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x412030
push str.plutil
push str.upport
push str.pplication_S
push str.Apple_A
lea eax, [ebp - 0x3ec]
push eax
push str._sSafari_s_s_s_s.exe
push dword [ebp + 0xc]
push esi
call fcn.00445d6d
push esi
push str._n_Final_plutil_path___s
call fcn.00449974
push esi
call fcn.00449791
add esp, 0x2c
dec eax
neg eax
sbb eax, eax
inc eax
jmp 0x412030
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x41203e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp dword [0x716864], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x20019
push eax
mov dword [ebp - 0x400], ecx
mov ecx, 0x20119
push str.GetVNCRegistryPassword
push str._s_entered____s
mov dword [ebp - 0x3fc], eax
cmovne esi, ecx
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x3f0]
push eax
push esi
mov esi, dword [ebp - 0x3fc]
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4120ca
push eax
push esi
push str.GetVNCRegistryPassword
push str._s_:_Failed_to_open_specified_VNC_key____s__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor eax, eax
jmp 0x41218d
mov edi, dword [ebp - 0x400]
lea eax, [ebp - 0x3f4]
push eax
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x3f4], 0x3e8
push eax
lea eax, [ebp - 0x3f8]
push eax
push 0
push edi
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x412125
push eax
push esi
push edi
push str.GetVNCRegistryPassword
push str._s_:_Failed_to_find_value__s_at_vnc_location__s__Error0x_.8x
call fcn.00449974
add esp, 0x14
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4120c3
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x3f4]
push dword [ebp - 0x3f8]
push str.Found_VNC_Password_of_Type___d__size___d
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x3ec]
cmp dword [ebp - 0x3f8], 3
je 0x412176
push eax
push str.Converting_password__s_to_HEX_bytes
call fcn.00449974
lea eax, [ebp - 0x3ec]
push ebx
push eax
call fcn.00449e5f
add esp, 0x10
jmp 0x412186
push dword [ebp - 0x3f4]
push eax
push ebx
call fcn.006269d0
add esp, 0xc
xor eax, eax
mov byte [ebx + 8], 0
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x414f4d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, str.Login_Data
mov dword [ebp - 0xc], 0x6172425c
lea edi, [ebp - 0x8c]
mov dword [ebp - 8], 0x5c6576
push 0x75
lea eax, [ebp - 0x81]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
push esi
push eax
call fcn.00626f50
push esi
push 0x14
call fcn.00415293
add esp, 0x14
lea eax, [ebp - 0x49c]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
pop edi
pop esi
test eax, eax
jns 0x414fc4
push str._n_Failed_to_get_current_users_local_appdata_folder
call fcn.00449974
pop ecx
jmp 0x415048
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x49c]
push eax
push 0x6730d0
lea eax, [ebp - 0x294]
push 0x208
push eax
call fcn.00445d6d
lea eax, [ebp - 0x294]
push eax
call fcn.00449791
add esp, 0x1c
test eax, eax
jne 0x415021
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x294]
push eax
push str.LoadPasswordFromBraveBrowser
push str._s_:_Specified_sleipnir_login_file___s__does_not_exist__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x415048
lea eax, [ebp - 0x294]
push eax
push str.LoadPasswordFromBraveBrowser
push str._s_:___Recovering_from_old_Brave_login_file__s
call fcn.00449974
lea eax, [ebp - 0x294]
push eax
push 0x14
call fcn.00415293
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005fe955
leave
ret
Function at 0x416bc7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f0
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x107]
push 0x103
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.00626f50
mov esi, str.LoadPasswordFromSafari
push esi
push 0x66c4b8
call fcn.00449974
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x416c3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x416cd1
lea eax, [ebp - 0x108]
push eax
push esi
push str._n__s___User_app_data_directory___s
call fcn.00449974
push str.plist
push str.hain.
push str.keyc
push str.rences
push str.terPrefe
push str.e_Compu
push str.Appl
lea eax, [ebp - 0x108]
push eax
push str._s_s_s_s_s_s_s_s
lea eax, [ebp - 0x4f0]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x4f0]
push eax
push str._n_Final_keychain_path___s
call fcn.00449974
add esp, 0x40
lea eax, [ebp - 0x4f0]
push eax
call fcn.00449791
pop ecx
test eax, eax
jne 0x416cc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s_Keychain_file_does_not_exist__Error0x_.8x
jmp 0x416c2c
lea eax, [ebp - 0x4f0]
push eax
call fcn.00416e6e
pop ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x416cdf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf
pop ecx
mov esi, str.Fenrir_IncSleipnir5_settingmodulesChromiumViewerDefault_
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
push 0xf
pop ecx
push 0x75
movsw word es:[edi], word [esi]
lea eax, [ebp - 0xf9]
mov esi, str.Fenrir_IncSleipnir_settingmodulesChromiumViewerDefault_
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.Login_Data
lea edi, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
push esi
push eax
call fcn.00626f50
add esp, 0xc
lea eax, [ebp - 0x514]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x416d5e
push str._n_Failed_to_get_current_users_local_appdata_folder
call fcn.00449974
pop ecx
jmp 0x416e60
push ebx
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x514]
push eax
push 0x6730d0
lea eax, [ebp - 0x30c]
push 0x208
push eax
call fcn.00445d6d
lea eax, [ebp - 0x30c]
push eax
call fcn.00449791
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
mov ebx, str._s_:_Specified_sleipnir_login_file___s__does_not_exist__Error0x_.8x
test eax, eax
jne 0x416dc3
call edi
push eax
lea eax, [ebp - 0x30c]
mov esi, str.LoadPasswordFromSleipnirBrowser
push eax
push esi
push ebx
call fcn.00449974
add esp, 0x10
jmp 0x416deb
lea eax, [ebp - 0x30c]
mov esi, str.LoadPasswordFromSleipnirBrowser
push eax
push esi
push str._s_:___Recovering_from_sleipnir_login_file
call fcn.00449974
lea eax, [ebp - 0x30c]
push eax
push 0xe
call fcn.00415293
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x514]
push eax
push 0x6730d0
lea eax, [ebp - 0x30c]
push 0x208
push eax
call fcn.00445d6d
lea eax, [ebp - 0x30c]
push eax
call fcn.00449791
add esp, 0x1c
test eax, eax
jne 0x416e3c
call edi
push eax
lea eax, [ebp - 0x30c]
push eax
push esi
push ebx
call fcn.00449974
add esp, 0x10
jmp 0x416e5f
lea eax, [ebp - 0x30c]
push eax
push esi
push str._s_:___Recovering_from_2nd_sleipnir_login_file
call fcn.00449974
lea eax, [ebp - 0x30c]
push eax
push 0xe
call fcn.00415293
add esp, 0x14
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005fe955
leave
ret