joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfb0
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x7d3]
push edi
mov edi, 0x3e7
xor ebx, ebx
push edi
push ebx
push eax
mov byte [ebp - 0x7d4], bl
call fcn.00626f50
push edi
lea eax, [ebp - 0x3eb]
mov byte [ebp - 0x3ec], bl
push ebx
push eax
call fcn.00626f50
push esi
mov edi, str.RecoverWebDrivePasswordsFromRegistry
push edi
push str._n_n_s_:_Reading_sie_values_from_reg_location__s
call fcn.00449974
add esp, 0x24
lea eax, [ebp - 0xfac]
push eax
push 0x20019
push ebx
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43bf4e
push esi
push eax
push edi
push str._s_:_Failed_to_open_the_site__Error0x_.8x___s
call fcn.00449974
add esp, 0x10
jmp 0x43c089
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xfa8]
push eax
lea eax, [ebp - 0xbbc]
mov dword [ebp - 0xfa8], 0x3e8
push eax
lea eax, [ebp - 0xfb0]
push eax
push ebx
push str.PassWord
push dword [ebp - 0xfac]
call edi
test eax, eax
jne 0x43c06a
mov esi, dword [ebp - 0xfa8]
cmp esi, 1
jb 0x43c06a
lea eax, [ebp - 0xfa8]
mov dword [ebp - 0xfa8], 0x3e8
push eax
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0xfb0]
push eax
push ebx
push 0x675830
push dword [ebp - 0xfac]
call edi
lea eax, [ebp - 0xfa8]
mov dword [ebp - 0xfa8], 0x3e8
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0xfb0]
push eax
push ebx
push str.UserName
push dword [ebp - 0xfac]
call edi
push dword [ebp - 0xfac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x7d4]
push eax
push str._n_n_n_n_Found_the_FTP_Account__Host:_s__Username_s__Password_d
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0xfa4]
push eax
lea eax, [ebp - 0xbbc]
push esi
push eax
call fcn.0040e32e
add esp, 0x20
cmp eax, 1
jne 0x43c065
push 0xffffffffffffffff
mov edx, 0x66ae5d
lea eax, [ebp - 0xfa4]
push edx
push eax
lea eax, [ebp - 0x3ec]
push eax
lea ecx, [ebp - 0x7d4]
push ecx
push edx
push 0x157
push 4
call fcn.00412c85
add esp, 0x20
xor eax, eax
inc eax
jmp 0x43c08b
push eax
push str.RecoverWebDrivePasswordsFromRegistry
push str._s_:_Failed_to_find_the_password_data_...returning
call fcn.00449974
add esp, 0xc
push dword [ebp - 0xfac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x43c09a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x403]
push edi
mov edi, 0x3ff
xor ebx, ebx
push edi
push ebx
push eax
mov byte [ebp - 0x404], bl
call fcn.00626f50
push edi
lea eax, [ebp - 0x1003]
mov byte [ebp - 0x1004], bl
push ebx
push eax
call fcn.00626f50
push edi
lea eax, [ebp - 0xc03]
mov byte [ebp - 0xc04], bl
push ebx
push eax
call fcn.00626f50
push edi
lea eax, [ebp - 0x803]
mov byte [ebp - 0x804], bl
push ebx
push eax
call fcn.00626f50
push esi
mov edi, str.RecoverWebPublisherPassFromRegistry
push edi
push str._n_n_s_:__Now_reading_from_Key_location__s
call fcn.00449974
add esp, 0x3c
lea eax, [ebp - 0x100c]
push eax
push 0x20019
push ebx
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43c156
push esi
push eax
push edi
push str._s_:_Failed_to_open_the_site_key__Error0x_.8x___s
call fcn.00449974
add esp, 0x10
xor eax, eax
jmp 0x43c26a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x404]
mov edi, 0x400
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1008], edi
push eax
push ebx
push str.Server
push dword [ebp - 0x100c]
call esi
lea eax, [ebp - 0x404]
push eax
call fcn.00631510
pop ecx
test eax, eax
je 0x43c1b1
lea eax, [ebp - 0x404]
push 0x5c
push eax
call fcn.006270b0
pop ecx
pop ecx
test eax, eax
je 0x43c1b1
mov byte [eax], bl
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], edi
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
push str.Username
push dword [ebp - 0x100c]
call esi
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], edi
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
push str.Password
push dword [ebp - 0x100c]
call esi
push dword [ebp - 0x100c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3e8
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0xc04]
push eax
call fcn.00408440
lea eax, [ebp - 0x804]
push eax
call fcn.00631510
add esp, 0x10
test eax, eax
je 0x43c267
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x804]
push ecx
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x404]
push eax
push ecx
push 0x152
push 4
call fcn.00412c85
add esp, 0x20
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x43c279
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7dc
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, str.RecoverWebsitePublisherPasswords
push esi
push str._s_:_Started
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x7dc]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwareCryerWebSitePublisher
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43c2d9
push eax
push esi
push str._s_:_Failed_to_find_winscp_entries_in_registry__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x43c36c
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7d8]
mov esi, ebx
push eax
lea eax, [ebp - 0x3ec]
push eax
push ebx
jmp 0x43c330
lea eax, [ebp - 0x3ec]
push eax
push str.SoftwareCryerWebSitePublisher_s
lea eax, [ebp - 0x7d4]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x7d4]
push eax
call fcn.0043c09a
add esp, 0x14
lea eax, [ebp - 0x7d8]
inc esi
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x3ec]
push eax
push esi
push dword [ebp - 0x7dc]
mov dword [ebp - 0x7d8], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x43c2f0
push eax
push str.RecoverWebsitePublisherPasswords
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x7dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x43dc70
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e2c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, str.RecoverWindowsLiveMessengerPassword
push edi
push str._s___Entered_...
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x4e28]
xor ebx, ebx
push eax
lea eax, [ebp - 0x4e2c]
push eax
push ebx
push str.WindowsLive
call dword [sym.imp.ADVAPI32.dll_CredEnumerateA]
test eax, eax
je 0x43ddf1
push esi
push dword [ebp - 0x4e2c]
push edi
push str._s_:_CredEnumerate_found__d_accounts
call fcn.00449974
add esp, 0xc
mov esi, ebx
cmp dword [ebp - 0x4e2c], ebx
jbe 0x43dde2
mov eax, dword [ebp - 0x4e28]
mov byte [ebp - 0x2714], bl
mov byte [ebp - 0x4e24], bl
mov eax, dword [eax + esi*4]
push dword [eax + 8]
push dword [eax + 4]
push edi
push str._s_:_Found_account_type__d____s
call fcn.00449974
mov ecx, dword [ebp - 0x4e28]
add esp, 0x10
mov eax, dword [ecx + esi*4]
cmp dword [eax + 0x30], ebx
je 0x43dd48
push dword [eax + 0x30]
lea eax, [ebp - 0x4e24]
push 0x2710
push eax
call fcn.006311ec
lea eax, [ebp - 0x4e24]
push eax
push edi
push str._s_:__Username___s
call fcn.00449974
mov ecx, dword [ebp - 0x4e28]
add esp, 0x18
mov eax, dword [ecx + esi*4]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x43ddb1
cmp dword [eax + 0x1c], ebx
je 0x43ddb1
push ebx
push ebx
push 0x400
lea edx, [ebp - 0x2714]
shr ecx, 1
push edx
push ecx
push dword [eax + 0x1c]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x4e28]
mov eax, dword [ecx + esi*4]
mov eax, dword [eax + 0x18]
shr eax, 1
cmp eax, 0x2710
jae 0x43de24
mov byte [ebp + eax - 0x2714], bl
lea eax, [ebp - 0x2714]
push eax
mov eax, dword [ecx + esi*4]
mov eax, dword [eax + 0x18]
shr eax, 1
push eax
push edi
push str._s_:__Password__d__s
call fcn.00449974
add esp, 0x10
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x2714]
push ecx
push eax
lea eax, [ebp - 0x4e24]
push eax
push ecx
push ecx
push 0x69
push 3
call fcn.00412c85
add esp, 0x20
inc esi
cmp esi, dword [ebp - 0x4e2c]
jb 0x43dce2
push dword [ebp - 0x4e28]
call dword [sym.imp.ADVAPI32.dll_CredFree]
pop esi
jmp 0x43de06
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.__s_:_CredEnumerate_failed_with_error_0x_.8x
call fcn.00449974
add esp, 0xc
push edi
push str._n_n_s___Finished_...
call fcn.00449974
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3
Function at 0x43fc98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2398
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x238b]
push edi
xor ebx, ebx
push 0x1387
push ebx
push eax
mov byte [ebp - 0x238c], bl
call fcn.00626f50
mov edi, 0x3ff
mov byte [ebp - 0x804], bl
push edi
lea eax, [ebp - 0x803]
push ebx
push eax
call fcn.00626f50
push edi
lea eax, [ebp - 0x403]
mov byte [ebp - 0x404], bl
push ebx
push eax
call fcn.00626f50
push esi
push str.SoftwareMartin_PrikrylWinSCP_2Sessions_s
lea eax, [ebp - 0x238c]
push 0x400
push eax
call fcn.00445d6d
lea eax, [ebp - 0x238c]
mov edi, str.RecoverWinscpFromRegistry
push eax
push edi
push str._n_n_s_:__Now_reading_from_WinSCP_Session_Reg_Key__s
call fcn.00449974
add esp, 0x40
lea eax, [ebp - 0x2394]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x238c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43fd65
push esi
push eax
push edi
push str._s_:_Failed_to_open_the_WinSCP_Session_key__Error0x_.8x___s
call fcn.00449974
add esp, 0x10
jmp 0x43fec7
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x2390]
push eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x2390], 0x400
push eax
lea eax, [ebp - 0x2398]
push eax
push ebx
push str.HostName
push dword [ebp - 0x2394]
call esi
lea eax, [ebp - 0x2390]
mov dword [ebp - 0x2390], 0x400
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x2398]
push eax
push ebx
push str.UserName
push dword [ebp - 0x2394]
call esi
lea eax, [ebp - 0x2390]
mov dword [ebp - 0x2390], 0x400
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x2398]
push eax
push ebx
push str.Password
push dword [ebp - 0x2394]
call esi
push dword [ebp - 0x2394]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x804]
push eax
call fcn.00631510
xor esi, esi
inc esi
pop ecx
cmp eax, esi
jb 0x43feba
lea eax, [ebp - 0x404]
push eax
call fcn.00631510
pop ecx
cmp eax, esi
jb 0x43feba
lea eax, [ebp - 0xc04]
push eax
call fcn.00631510
pop ecx
cmp eax, esi
jb 0x43feba
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push eax
push edi
push str._s_:__Found_the_FTP_Account__Host:_s__Username_s__Password_s
call fcn.00449974
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.0040e954
add esp, 0x28
cmp eax, esi
jne 0x43feb6
push 0xffffffffffffffff
mov edx, 0x66ae5d
lea eax, [ebp - 0x1004]
push edx
push eax
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x804]
push ecx
push edx
push 0x136
push 4
call fcn.00412c85
add esp, 0x20
mov eax, esi
jmp 0x43fec9
push edi
push str._n_s_:_Error:_Either_host_or_username_or_password_is_empty__returning_now
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x4401af
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d4
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x3e7
lea eax, [ebp - 0x3eb]
xor ebx, ebx
push esi
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.00626f50
push esi
lea eax, [ebp - 0x7d3]
mov byte [ebp - 0x7d4], bl
push ebx
push eax
call fcn.00626f50
add esp, 0x18
lea eax, [ebp - 0x7d4]
push eax
push ebx
push ebx
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x44022c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverXManagerPasswords
push str._s_Failed_to_find_my_documents_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x4402e7
push edi
lea eax, [ebp - 0x7d4]
push eax
push str._n_Found_documents_path___s
call fcn.00449974
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x7d4]
push eax
mov ebx, 0x15d
mov ecx, str._sNetSarangXftpSessions
cmp esi, ebx
mov eax, str._sNetSarangXshellSessions
mov edi, 0x3e8
cmove eax, ecx
push eax
lea eax, [ebp - 0x3ec]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3ec]
push eax
push esi
call fcn.00440a02
lea eax, [ebp - 0x7d4]
mov ecx, str._sNetSarang_Computer6XftpSessions
push eax
cmp esi, ebx
mov eax, str._sNetSarang_Computer6XshellSessions
cmove eax, ecx
push eax
lea eax, [ebp - 0x3ec]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3ec]
push eax
push esi
call fcn.00440a02
lea eax, [ebp - 0x7d4]
mov ecx, str._sNetSarang_Computer7XftpSessions
push eax
cmp esi, ebx
mov eax, str._sNetSarang_Computer7XshellSessions
cmove eax, ecx
push eax
lea eax, [ebp - 0x3ec]
push edi
push eax
call fcn.00445d6d
add esp, 0x48
lea eax, [ebp - 0x3ec]
push eax
push esi
call fcn.00440a02
pop ecx
pop ecx
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x440a02
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcfc
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, str.RecoverXManagerPasswordsFromFolder
push esi
push dword [ebp + 8]
push ebx
push str._n_n_n_s_Searching_for_app__d_files_in_session_location___s_
call fcn.00449974
push esi
call fcn.0044975e
add esp, 0x14
test eax, eax
jne 0x440a51
push esi
push ebx
push str._s_Session_location_does_not_exist___s_
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x440ba2
push edi
push esi
mov edi, 0x400
lea eax, [ebp - 0x7d4]
push edi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x7d4]
push edi
push eax
call fcn.00631246
lea eax, [ebp - 0x7d4]
push eax
push ebx
push str._s_:__Searching_for_XFtp_XShell_Account_files_within_folder__s
call fcn.00449974
add esp, 0x24
lea eax, [ebp - 0xcfc]
push eax
lea eax, [ebp - 0x7d4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x440ac4
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str._s_FindFirstFileA_failed_to_start_search_in_location__Error0x_.8x____s_
call fcn.00449974
add esp, 0x10
xor eax, eax
jmp 0x440ba1
test byte [ebp - 0xcfc], 0x10
jne 0x440b81
lea eax, [ebp - 0xcd0]
push eax
lea eax, [ebp - 0x3ec]
push 0x3e8
push eax
call fcn.006311ec
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
inc eax
push eax
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631711
add esp, 0x18
lea eax, [ebp - 0x3ec]
cmp dword [ebp + 8], 0x15d
jne 0x440b2d
push str..xfp
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
je 0x440b81
mov eax, str._s_:__Found_XFTP_Account_file__s
jmp 0x440b43
push str..xsh
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
je 0x440b81
mov eax, str._s_:__Found_XShell_Account_file__s
lea ecx, [ebp - 0xcd0]
push ecx
push ebx
push eax
call fcn.00449974
lea eax, [ebp - 0xcd0]
push eax
push esi
push 0x66c218
lea eax, [ebp - 0xbbc]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0xbbc]
push eax
push dword [ebp + 8]
call fcn.004402f5
add esp, 0x28
lea eax, [ebp - 0xcfc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x440ac4
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x440ebc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1880
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 0x1873]
push 0x1387
push ebx
push eax
mov byte [ebp - 0x1874], bl
call fcn.00626f50
push 0x3e7
lea eax, [ebp - 0x4eb]
mov byte [ebp - 0x4ec], bl
push ebx
push eax
call fcn.00626f50
push 0xff
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], bl
push ebx
push eax
call fcn.00626f50
mov edi, str.RecoverYahooMesgrPassword
push edi
push str._n_n_s_:_Now_Looking_for_Yahoo_Msgr
call fcn.00449974
add esp, 0x2c
lea eax, [ebp - 0x187c]
push eax
push 0x20019
push ebx
push str.SoftwareYahoopager
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x440f69
push eax
push edi
push str._s_:_Failed_to_find_Yahoo_stored_entries_in_registry__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x4410e0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1878]
push eax
lea eax, [ebp - 0x4ec]
mov dword [ebp - 0x1878], 0x3e8
push eax
lea eax, [ebp - 0x1880]
push eax
push ebx
push str.Yahoo__User_ID
push dword [ebp - 0x187c]
call esi
test eax, eax
je 0x440fb0
push ebx
push edi
push str._s_:_Failed_to_find_Yahoo_User_ID__Error0x_.8x
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x4ec]
push eax
push edi
push str._s_:__Found_Yahoo_user_id____s
call fcn.00449974
add esp, 0xc
mov dword [ebp - 0x1878], 0x1388
lea eax, [ebp - 0x1878]
push eax
lea eax, [ebp - 0x1874]
push eax
lea eax, [ebp - 0x1880]
push eax
push ebx
push 0x67a048
push dword [ebp - 0x187c]
call esi
test eax, eax
je 0x44103c
lea eax, [ebp - 0x1878]
mov dword [ebp - 0x1878], 0x1388
push eax
lea eax, [ebp - 0x1874]
push eax
lea eax, [ebp - 0x1880]
push eax
push ebx
push str.EOptions_String
push dword [ebp - 0x187c]
call esi
test eax, eax
je 0x441035
push ebx
push edi
push str._s_:_Failed_to_find_stored_Yahoo_Password__in_registry__Error0x_.8x
call fcn.00449974
jmp 0x441052
push str.Yahoo_Messenger_v6.x
jmp 0x441041
push str.Yahoo_Messenger_v7.x
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.006311ec
add esp, 0xc
push dword [ebp - 0x187c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1874]
push eax
call fcn.00631510
xor esi, esi
inc esi
pop ecx
cmp eax, esi
jbe 0x44108a
lea eax, [ebp - 0x1874]
push eax
push edi
push str._s_:__Found_Yahoo_Password_____s
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x4ec]
push eax
call fcn.00631510
pop ecx
cmp eax, esi
ja 0x4410ac
lea eax, [ebp - 0x1874]
push eax
call fcn.00631510
pop ecx
cmp eax, esi
jbe 0x4410d0
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x1874]
push ecx
push eax
lea eax, [ebp - 0x4ec]
push eax
push ecx
push ecx
push 0x67
push 3
call fcn.00412c85
add esp, 0x20
push edi
push str._s_:_Finished_checking_Yahoo_Msgr
call fcn.00449974
pop ecx
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x44329c
Capabilities:
Link many functions at runtime

Disassembly:
and dword [0x71686c], 0
push edi
mov edi, str.SetupVaultService
push edi
push str._s_:__Entered
call fcn.00449974
pop ecx
pop ecx
push str.vaultcli.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x717048], eax
test eax, eax
jne 0x4432e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_:__LoadLibrary_failed_to_load_vault_dll___0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
pop edi
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.VaultOpenVault
push eax
call esi
push str.VaultCloseVault
push dword [0x717048]
mov dword [0x724774], eax
call esi
push str.VaultEnumerateItems
push dword [0x717048]
mov dword [0x724778], eax
call esi
push str.VaultFree
push dword [0x717048]
mov dword [0x72477c], eax
call esi
push str.VaultRemoveItem
push dword [0x717048]
mov dword [0x724784], eax
call esi
push str.VaultGetItem
push dword [0x717048]
mov dword [0x724788], eax
call esi
cmp dword [0x724774], 0
mov dword [0x724780], eax
je 0x443393
cmp dword [0x72477c], 0
je 0x443393
cmp dword [0x724778], 0
je 0x443393
cmp dword [0x724784], 0
je 0x443393
test eax, eax
je 0x443393
xor esi, esi
inc esi
push edi
push str._s_:__Successfully_setup_and_loaded_Windows_Vault_functions
mov dword [0x71686c], esi
call fcn.00449974
pop ecx
pop ecx
mov eax, esi
jmp 0x4433b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_:__Failed_to_get_one_or_two_function_address_from_vault_dll___0x_.8x
call fcn.00449974
add esp, 0xc
push dword [0x717048]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop esi
pop edi
ret

Function at 0x443869
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4438c3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4438c3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4438b3
cmp esi, ecx
jae 0x4438c3
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x4438a1
cmp esi, ecx
jae 0x4438c3
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
jmp 0x4438c5
xor eax, eax
pop esi
pop ebp
ret