joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e843
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x272c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
push esi
call fcn.00631510
pop ecx
push eax
push str.DecryptWindowsMailPassword
push str._n_n_s_____Decrypting_Password__d___s
call fcn.00449974
lea eax, [ebp - 0x2714]
xor ebx, ebx
push eax
push esi
mov byte [edi], bl
call fcn.00449e5f
lea eax, [ebp - 0x2714]
push esi
mov dword [ebp - 0x2728], eax
call fcn.00631510
add esp, 0x1c
shr eax, 1
mov dword [ebp - 0x272c], eax
mov eax, dword [0x716c58]
mov dword [ebp - 0x2724], eax
lea eax, [ebp - 0x271c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2724]
mov dword [ebp - 0x2720], 0x716870
push eax
push ebx
lea eax, [ebp - 0x272c]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x40e92a
mov ecx, dword [ebp - 0x2718]
mov eax, dword [ebp - 0x271c]
mov byte [eax + ecx], bl
push dword [ebp - 0x2718]
push dword [ebp - 0x271c]
push str._n_n_Successfully_decrypted_the_password___d____S
call fcn.00449974
mov eax, dword [ebp - 0x271c]
add esp, 0xc
shr eax, 1
push ebx
push ebx
push dword [ebp + 0x10]
push edi
push eax
push dword [ebp - 0x2718]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
inc eax
jmp 0x40e945
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DecryptWindowsMailPassword
push str._n_n_s_____________CryptUnprotectData_Failed__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x40eb56
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x272c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2720], eax
mov eax, dword [ebp + 0x10]
push edi
push esi
mov dword [ebp - 0x2724], eax
and dword [eax], 0
call fcn.00631510
mov ebx, eax
mov edi, str.DecryptWirelessPassword
push ebx
push edi
push str._s___Decrypting_the_Wireless_password_of_size__d
call fcn.00449974
add esp, 0x10
test bl, 1
je 0x40ebb5
push ebx
push edi
push str._s___Invalid_Encrypted_Data_of_size__d._It_Should_be_of_EVEN_length
jmp 0x40ec6e
push esi
call fcn.00631510
pop ecx
mov ebx, eax
shr ebx, 1
push 0
pop edi
je 0x40ebe4
lea ecx, [ebp - 0x2714]
add ecx, edi
push ecx
push str._2hhx
push esi
call fcn.00445d89
add esp, 0xc
add esi, 2
inc edi
cmp edi, ebx
jl 0x40ebc5
lea eax, [ebp - 0x2714]
mov dword [ebp - 0x272c], ebx
mov dword [ebp - 0x2728], eax
lea eax, [ebp - 0x271c]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x272c]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x40ec5d
push dword [ebp - 0x271c]
mov ebx, dword [ebp - 0x2720]
push dword [ebp - 0x2718]
push ebx
call fcn.006269d0
mov eax, dword [ebp - 0x271c]
mov ecx, dword [ebp - 0x2724]
push ebx
mov byte [ebx + eax], 0
mov eax, dword [ebp - 0x271c]
push eax
push str.DecryptWirelessPassword
push str._s___Successfully_decrypted_the_password__size___d__n_password_s
mov dword [ecx], eax
call fcn.00449974
xor eax, eax
add esp, 0x1c
inc eax
jmp 0x40ec78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DecryptWirelessPassword
push str._s____CryptUnprotectData_Failed_with_Error__0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x40f6b7
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x14
push eax
xor esi, esi
push esi
push esi
push 0x8004
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40f74d
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40f744
push edi
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push esi
push eax
push edi
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40f743
mov eax, dword [ebp - 4]
push ebx
mov ebx, eax
shr ebx, 2
test ebx, ebx
je 0x40f72c
push dword [edi + esi*4]
call fcn.0063d3cf
mov dword [edi + esi*4], eax
inc esi
pop ecx
cmp esi, ebx
jb 0x40f718
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
push str.FFFTP_GenSha1Hash5
push str._s:_Successfully_generated_FFFTP_SHA1_HASH___d__for_secret__s__n_n
call fcn.00449974
add esp, 0x10
pop ebx
pop edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop esi
leave
ret

Function at 0x40f750
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push str._n_n_n__Now_searching_for_PRF_files_in__s
call fcn.00449974
push edi
mov ebx, 0x3e8
lea eax, [ebp - 0x3ec]
push ebx
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x3ec]
push ebx
push eax
call fcn.00631246
add esp, 0x20
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f7bb
xor eax, eax
jmp 0x40f82e
test byte [ebp - 0x914], 0x10
jne 0x40f812
lea eax, [ebp - 0x8e8]
push 0x2e
push eax
call fcn.006271e0
pop ecx
pop ecx
test eax, eax
je 0x40f812
push str..PRF
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
jne 0x40f812
lea eax, [ebp - 0x8e8]
push eax
push edi
push 0x66c218
lea eax, [ebp - 0x7d4]
push ebx
push eax
call fcn.00445d6d
lea eax, [ebp - 0x7d4]
push eax
call fcn.0042c3cb
add esp, 0x18
lea eax, [ebp - 0x914]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40f7bb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x40faa0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcfc
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov edi, 0x3e8
lea eax, [ebp - 0x7d4]
push edi
push eax
call fcn.006311ec
lea eax, [ebp - 0x7d4]
mov ebx, str.FindFoxmail6_AccountFile
push eax
push ebx
push str._s_Now_Searching_for_Foxmail6_accounts_in_path__s
call fcn.00449974
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x3ec]
push edi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x3ec]
push edi
push eax
call fcn.00631246
lea eax, [ebp - 0x3ec]
push eax
push str._n_Searching_for_Foxmail6_account_files_in_the_folder__s
call fcn.00449974
add esp, 0x38
lea eax, [ebp - 0xcfc]
push eax
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40fbd7
test byte [ebp - 0xcfc], 0x10
je 0x40fbba
cmp byte [ebp - 0xcd0], 0x2e
je 0x40fbba
lea eax, [ebp - 0xcd0]
push eax
push ebx
push str._s___Found_the_Directory___s
call fcn.00449974
lea eax, [ebp - 0xcd0]
push eax
lea eax, [ebp - 0x7d4]
push eax
push str._s_sAccount.stg
lea eax, [ebp - 0xbbc]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0xbbc]
push eax
push ebx
push str._s___Checking_for_profile_file__s
call fcn.00449974
lea eax, [ebp - 0xbbc]
push eax
call fcn.00449791
add esp, 0x30
test eax, eax
je 0x40fbba
lea eax, [ebp - 0xbbc]
push eax
lea eax, [ebp - 0xcd0]
push eax
call fcn.0040a5be
pop ecx
pop ecx
lea eax, [ebp - 0xcfc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40fb3c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x40fbe6
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcfc
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov ebx, 0x3e8
lea eax, [ebp - 0x3ec]
push ebx
push eax
call fcn.006311ec
lea eax, [ebp - 0x3ec]
mov edi, str.FindFoxmail72_AccountFile
push eax
push edi
push str._s_Now_Searching_for_Foxmail7_2_Account_in_path__s
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0xbbc]
push ebx
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0xbbc]
push ebx
push eax
call fcn.00631246
add esp, 0x30
lea eax, [ebp - 0xcfc]
push eax
lea eax, [ebp - 0xbbc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40fd07
test byte [ebp - 0xcfc], 0x10
je 0x40fcea
lea eax, [ebp - 0xcd0]
push eax
push edi
push str._s___Found_folder__s
call fcn.00449974
add esp, 0xc
cmp byte [ebp - 0xcd0], 0x2e
je 0x40fcea
lea eax, [ebp - 0xcd0]
push eax
lea eax, [ebp - 0x3ec]
push eax
push str._s_sAccountsAccount.rec0
lea eax, [ebp - 0x7d4]
push ebx
push eax
call fcn.00445d6d
lea eax, [ebp - 0x7d4]
push eax
push edi
push str._s___Checking_for_Foxmail7_2_account_file__s
call fcn.00449974
lea eax, [ebp - 0x7d4]
push eax
call fcn.00449791
add esp, 0x24
test eax, eax
je 0x40fcea
lea eax, [ebp - 0x7d4]
push eax
call fcn.0040ab7f
pop ecx
lea eax, [ebp - 0xcfc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40fc71
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x410068
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4c
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov esi, 0x208
push esi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x20c]
push eax
push str.FindUCPasswordFile
push str._s_Searching_for_UC_Password_file_within_profile_path__s
call fcn.00449974
add esp, 0x24
lea eax, [ebp - 0xb4c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4100e0
xor eax, eax
jmp 0x4101a7
push ebx
mov ebx, 0x400
test byte [ebp - 0xb4c], 0x10
jne 0x410186
lea eax, [ebp - 0xb20]
push eax
lea eax, [ebp - 0x60c]
push ebx
push eax
call fcn.006311ec
lea eax, [ebp - 0x60c]
push eax
call fcn.00631510
inc eax
push eax
lea eax, [ebp - 0x60c]
push eax
call fcn.00631711
push str.uc_login_data
call fcn.00631510
push eax
lea eax, [ebp - 0x60c]
push str.uc_login_data
push eax
call fcn.00631760
add esp, 0x28
test eax, eax
jne 0x410186
lea eax, [ebp - 0x60c]
push str.journal
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x410186
lea eax, [ebp - 0xb20]
push eax
push edi
push 0x66c218
lea eax, [ebp - 0xa0c]
push ebx
push eax
call fcn.00445d6d
lea eax, [ebp - 0xa0c]
push eax
push 0xb
call fcn.00415293
add esp, 0x1c
lea eax, [ebp - 0xb4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4100e6
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005fe955
leave
ret
Function at 0x4101b5
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcfc
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x3ec]
push edi
mov esi, 0x400
push esi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x3ec]
push eax
push str.FindWindowsMailAccountFiles
push str._s_:__Searching_for_Windows_Live_Mail_Account_files_within_folder__s
call fcn.00449974
add esp, 0x24
lea eax, [ebp - 0xcfc]
push eax
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4102e3
push ebx
mov ebx, 0x3e8
test byte [ebp - 0xcfc], 0x10
jne 0x4102c5
lea eax, [ebp - 0xcd0]
push eax
lea eax, [ebp - 0x7d4]
push ebx
push eax
call fcn.006311ec
lea eax, [ebp - 0x7d4]
push eax
call fcn.00631510
inc eax
push eax
lea eax, [ebp - 0x7d4]
push eax
call fcn.00631711
lea eax, [ebp - 0x7d4]
push str..oeaccount
push eax
call fcn.00627320
add esp, 0x20
test eax, eax
je 0x4102c5
lea eax, [ebp - 0xcd0]
push eax
push str.FindWindowsMailAccountFiles
push str._s_:__Found_Account_file__s
call fcn.00449974
lea eax, [ebp - 0xcd0]
push eax
push edi
push 0x66c218
lea eax, [ebp - 0xbbc]
push ebx
push eax
call fcn.00445d6d
lea eax, [ebp - 0xbbc]
push eax
push dword [ebp + 8]
call fcn.0043de80
add esp, 0x28
lea eax, [ebp - 0xcfc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410230
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005fe955
leave
ret
Function at 0x410563
Capabilities:
Encode data using xor

Disassembly:
push 0x58c
mov eax, 0x659aee
call fcn.005fe9c8
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x588]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x594], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x598], ebx
mov dword [ebp - 0x590], eax
call fcn.004033fa
and dword [ebp - 4], 0
xor edi, edi
mov esi, dword [ebp + 0x20]
inc edi
cmp esi, edi
jl 0x4106e8
cmp dword [ebp + 0x1c], 0
je 0x4106e8
test ebx, ebx
je 0x4106e8
cmp ebx, 0xc8
ja 0x4106e8
push ebx
push dword [ebp - 0x58c]
lea eax, [ebp - 0x434]
push eax
call fcn.006269d0
mov ecx, edi
lea edx, [ebx + 4]
add esp, 0xc
mov dword [ebp - 0x58c], ecx
mov eax, ecx
mov byte [ebp + ebx - 0x431], cl
sar eax, 0x18
mov byte [ebp + ebx - 0x434], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp + ebx - 0x433], al
mov eax, ecx
sar eax, 8
lea ecx, [ebp - 0x588]
mov byte [ebp + ebx - 0x432], al
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x434]
push dword [ebp - 0x594]
push edx
push eax
call fcn.0044a73b
push 0x14
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.006269d0
add esp, 0xc
cmp esi, edi
jle 0x4106a0
mov ebx, dword [ebp - 0x594]
dec esi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push ebx
push 0x14
push eax
lea ecx, [ebp - 0x588]
call fcn.0044a73b
push 0x14
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.006269d0
add esp, 0xc
xor ecx, ecx
mov al, byte [ebp + ecx - 0x24]
xor byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0x14
jb 0x410687
sub esi, 1
jne 0x41065a
mov ebx, dword [ebp - 0x598]
push 0x14
pop esi
cmp dword [ebp + 0x1c], esi
lea eax, [ebp - 0x38]
cmovb esi, dword [ebp + 0x1c]
push esi
push eax
push dword [ebp - 0x590]
call fcn.006269d0
mov eax, dword [ebp + 0x1c]
lea edx, [ebx + 4]
add dword [ebp - 0x590], esi
sub eax, esi
mov ecx, dword [ebp - 0x58c]
add esp, 0xc
mov esi, dword [ebp + 0x20]
inc ecx
mov dword [ebp + 0x1c], eax
mov dword [ebp - 0x58c], ecx
test eax, eax
jne 0x4105f2
jmp 0x4106ea
xor edi, edi
lea ecx, [ebp - 0x588]
call fcn.00404273
mov eax, edi
call fcn.005fe977
ret
Function at 0x410736
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x107]
xor ebx, ebx
push 0x103
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.00626f50
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x41079e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetBatProfilePath
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x4107f4
lea eax, [ebp - 0x108]
push eax
push str._n_User_app_data_directory___s
call fcn.00449974
lea eax, [ebp - 0x108]
push eax
push str._sThe_Bat_
push 0x208
push esi
call fcn.00445d6d
push esi
push str._n_Final_profile_path_of_Bat___s
call fcn.00449974
push esi
call fcn.0044975e
add esp, 0x24
test eax, eax
jne 0x4107f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetBatProfilePath
push str._s_The_Bat_Profile_path_does_not_exist__Error0x_.8x
jmp 0x410792
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret

Function at 0x410802
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3eb]
xor ebx, ebx
push 0x3e7
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.00626f50
add esp, 0xc
mov byte [esi], bl
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push ebx
push str.SoftwareRimArtsB2Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x410874
push eax
push str.GetBeckyDataPath
push str._s_:_Failed_to_find_the_location__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x410920
push edi
lea eax, [ebp - 0x3f4]
mov edi, 0x3e8
push eax
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x3f4], edi
push eax
lea eax, [ebp - 0x3f8]
push eax
push ebx
push str.DataDir
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp eax, 1
jae 0x4108c9
xor eax, eax
jmp 0x41091f
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp byte [ebp + eax - 0x3ed], 0x5c
jne 0x4108f9
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
dec eax
pop ecx
cmp eax, edi
jae 0x41092e
mov byte [ebp + eax - 0x3ec], bl
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp + 0xc]
push esi
call fcn.006311ec
push esi
push str.GetBeckyDataPath
push str._s_:_Found_in_registry_Becky_data_location_is
call fcn.00449974
xor eax, eax
add esp, 0x18
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3
Function at 0x410934
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.SoftwareBeyluxe_Messenger
push SysReAllocString
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x410991
push eax
push str.GetBeyluxeInstallRootPath
push str._s_:_Failed_to_open_the_Beyluxe_registry_account_key__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x410a12
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.Buzz
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4109e3
push esi
push str.GetBeyluxeInstallRootPath
push str._s_:_RegQueryValueEx_failed_to_read_the_Buzz___Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x410a11
lea eax, [ebp - 0x20c]
push eax
push str.GetBeyluxeInstallRootPath
push str._s_:_RegQueryValueEx_read_the_value_for_Buzz___s
call fcn.00449974
push 3
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00631360
xor eax, eax
add esp, 0x1c
inc eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.005fe955
leave
ret
Function at 0x410fff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfb0
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xbbb]
push edi
mov edi, 0x3e7
xor ebx, ebx
push edi
push ebx
push eax
mov byte [ebp - 0xbbc], bl
call fcn.00626f50
push edi
lea eax, [ebp - 0x7d3]
mov byte [ebp - 0x7d4], bl
push ebx
push eax
call fcn.00626f50
push edi
lea eax, [ebp - 0x3eb]
mov byte [ebp - 0x3ec], bl
push ebx
push eax
call fcn.00626f50
push edi
lea eax, [ebp - 0xfa3]
mov byte [ebp - 0xfa4], bl
push ebx
push eax
call fcn.00626f50
add esp, 0x30
lea eax, [ebp - 0xfac]
push eax
push 0x20019
push ebx
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4110aa
push eax
push esi
push str.GetCoreFtpPassword
push str._s_:_Failed_to_open_CoreFTP_Site_location__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor eax, eax
jmp 0x4111d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xfa8]
push eax
lea eax, [ebp - 0xbbc]
mov edi, 0x3e8
push eax
lea eax, [ebp - 0xfb0]
mov dword [ebp - 0xfa8], edi
push eax
push ebx
push str.Host
push dword [ebp - 0xfac]
call esi
lea eax, [ebp - 0xfa8]
mov dword [ebp - 0xfa8], edi
push eax
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0xfb0]
push eax
push ebx
push str.User
push dword [ebp - 0xfac]
call esi
lea eax, [ebp - 0xfa8]
mov dword [ebp - 0xfa8], edi
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0xfb0]
push eax
push ebx
push 0x676854
push dword [ebp - 0xfac]
call esi
push dword [ebp - 0xfac]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp eax, 1
jae 0x411168
push esi
push str.GetCoreFtpPassword
push str._s_:_RegQueryValueEx_failed_to_read_the_password_value_for_site_or_Password_is_empty__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x4110a3
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0xbbc]
push eax
push str.GetCoreFtpPassword
push str._s_:_Found_Server_s__User_s__Enc_Password_s
call fcn.00449974
push edi
lea eax, [ebp - 0xfa4]
push eax
lea eax, [ebp - 0x3ec]
push eax
call fcn.00408e54
push 0xffffffffffffffff
mov edx, 0x66ae5d
lea eax, [ebp - 0xfa4]
push edx
push eax
lea ecx, [ebp - 0x7d4]
push ecx
lea ecx, [ebp - 0xbbc]
push ecx
push edx
push 0x133
push 4
call fcn.00412c85
xor eax, eax
add esp, 0x40
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret