joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431bde
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb28
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x3f7]
push edi
mov esi, str.Miranda
mov byte [ebp - 0x3f8], 0
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x3e7
push esi
push 0
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x9e7]
mov byte [ebp - 0x9e8], 0
push 0
push eax
call fcn.00626f50
push ebx
call fcn.00631510
add esp, 0x1c
cmp eax, 1
lea eax, [ebp - 0x3f8]
jae 0x431c90
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x431c79
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverMirandaPassword
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x431dab
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3f8]
push 0x3e8
push eax
call fcn.00631246
jmp 0x431c9c
push ebx
push 0x3e8
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x3f8]
mov ebx, str.RecoverMirandaPassword
push eax
push ebx
push str._s_Final_Miranda_IM_profile__path_is__s
call fcn.00449974
lea eax, [ebp - 0x3f8]
mov edi, 0x208
push eax
lea eax, [ebp - 0x600]
push edi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x600]
push edi
push eax
call fcn.00631246
lea eax, [ebp - 0x600]
push eax
push str._n_Searching_for_Miranda_profile_files_in_the_folder__s
call fcn.00449974
add esp, 0x2c
lea eax, [ebp - 0xb28]
push eax
lea eax, [ebp - 0x600]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x431c72
test byte [ebp - 0xb28], 0x10
je 0x431d8b
cmp byte [ebp - 0xafc], 0x2e
je 0x431d8b
lea eax, [ebp - 0xafc]
push eax
push ebx
push str._s___Found_the_Directory___s
call fcn.00449974
lea eax, [ebp - 0xafc]
push eax
push eax
lea eax, [ebp - 0x3f8]
push eax
push str._s_s_s.dat
lea eax, [ebp - 0x9e8]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x9e8]
push eax
push ebx
push str._s___Checking_for_account_file__s
call fcn.00449974
lea eax, [ebp - 0x9e8]
push eax
call fcn.00449791
add esp, 0x34
test eax, eax
je 0x431d8b
lea eax, [ebp - 0x9e8]
push eax
call fcn.00431dba
pop ecx
lea ecx, [ebp - 0xb28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x431d14
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x433973
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f50
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x7d3]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x3e7
push ebx
push 0
push eax
mov byte [ebp - 0x7d4], 0
call fcn.00626f50
push 0x1387
lea eax, [ebp - 0x1f43]
mov byte [ebp - 0x1f44], 0
push 0
push eax
call fcn.00626f50
push ebx
lea eax, [ebp - 0x3eb]
mov byte [ebp - 0x3ec], 0
push 0
push eax
call fcn.00626f50
push ebx
xor ebx, ebx
mov byte [ebp - 0xbbc], 0
lea eax, [ebp - 0xbbb]
push ebx
push eax
call fcn.00626f50
push esi
push str.SoftwareA.V.M.Paltalk_NGcommon_settingscoreuserscreds_s
lea eax, [ebp - 0x1f44]
push 0x1388
push eax
call fcn.00445d6d
add esp, 0x40
lea eax, [ebp - 0x1f44]
mov esi, str.RecoverNewPaltakFromRegistry
push eax
push esi
push str._s_:_Recovering_from_registry_key__s
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x1f4c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1f44]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x433a67
push eax
lea eax, [ebp - 0x1f44]
push eax
push esi
push str._s_:_Failed_to_open_the_paltalk_account_key___s___Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x433b81
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1f48]
push eax
lea eax, [ebp - 0x7d4]
mov dword [ebp - 0x1f48], 0x3e8
push eax
lea eax, [ebp - 0x1f50]
push eax
push ebx
push str.nickname
push dword [ebp - 0x1f4c]
call esi
lea eax, [ebp - 0x1f48]
mov dword [ebp - 0x1f48], 0x3e8
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x1f50]
push eax
push ebx
push 0x66c3ec
push dword [ebp - 0x1f4c]
call esi
mov esi, eax
lea eax, [ebp - 0x3ec]
push eax
push eax
call fcn.00631510
pop ecx
push eax
lea eax, [ebp - 0x7d4]
mov ebx, str.RecoverNewPaltakFromRegistry
push eax
push ebx
push str._s_:_Found_nickname__s__enc_password___d___s
call fcn.00449974
add esp, 0x14
push dword [ebp - 0x1f4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7d4]
push eax
call fcn.00631510
pop ecx
cmp eax, 1
jb 0x433b72
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp eax, 1
jb 0x433b72
push 0x3e8
lea eax, [ebp - 0xbbc]
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x7d4]
push eax
push edi
call fcn.0040cbb7
add esp, 0x14
test eax, eax
je 0x433b6d
push 0xffffffffffffffff
mov edx, 0x66ae5d
lea eax, [ebp - 0xbbc]
push edx
push eax
lea ecx, [ebp - 0x7d4]
push ecx
push edx
push edx
push 0x6b
push 3
call fcn.00412c85
add esp, 0x20
xor eax, eax
inc eax
jmp 0x433b83
push esi
push ebx
push str._s_:_Failed_to_read_the_paltalk_nick_pass_for_the_account__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x433b92
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x81b]
push esi
push edi
push 0x3e7
push 0
push eax
mov byte [ebp - 0x81c], 0
call fcn.00626f50
push 8
pop ecx
mov esi, str.Trillianusersglobal_accounts.dat
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
push 8
pop ecx
push ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.Trillianusersglobal_accounts.ini
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00631510
add esp, 0x10
cmp eax, 1
jbe 0x433c5d
push str.accounts.dat
push ebx
mov esi, 0x66c218
lea eax, [ebp - 0x434]
push esi
mov edi, 0x3e8
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x434]
push eax
call fcn.00449791
add esp, 0x18
test eax, eax
je 0x433c35
lea ecx, [ebp - 0x434]
push ecx
call fcn.0040dfb4
jmp 0x433d39
push str.accounts.ini
push ebx
push esi
lea eax, [ebp - 0x434]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x434]
push eax
call fcn.00449791
add esp, 0x18
jmp 0x433d29
lea eax, [ebp - 0x81c]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x433c95
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverNewTrillianPasswords
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x433d3d
lea eax, [ebp - 0x28]
mov esi, 0x66c218
push eax
lea eax, [ebp - 0x81c]
mov edi, 0x3e8
push eax
push esi
lea eax, [ebp - 0x434]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x434]
mov ebx, str.RecoverNewTrillianPasswords
push eax
push ebx
push str._s_Checking_for_new_trillion_account_path_is__s
call fcn.00449974
lea eax, [ebp - 0x434]
push eax
call fcn.00449791
add esp, 0x24
test eax, eax
je 0x433cef
lea eax, [ebp - 0x434]
push eax
call fcn.0040dfb4
pop ecx
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x81c]
push eax
push esi
lea eax, [ebp - 0x434]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x434]
push eax
push ebx
push str._s_Checking_for_old_trillion_astra_account_path_is__s
call fcn.00449974
lea eax, [ebp - 0x434]
push eax
call fcn.00449791
add esp, 0x24
test eax, eax
je 0x433d3a
lea eax, [ebp - 0x434]
push eax
call fcn.0042bec8
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x434203
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, str.RecoverNimbuzzPassword
push edi
push str._s___started
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0xc0c]
push eax
push 0x20019
push 0
push str.SoftwareNimbuzzPCClientApplication
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x434261
push eax
push edi
push str._s_:_Failed_to_open_the_Nimbuzz_account_registry_key__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x434367
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0xc08], 0x400
push eax
lea eax, [ebp - 0xc10]
push eax
push 0
push str.Username
push dword [ebp - 0xc0c]
call esi
test eax, eax
je 0x4342a6
push eax
push edi
push str._s_:_RegQueryValueEx_failed_to_read_the_nimbuzz_username__Error0x_.8x
jmp 0x43435c
lea eax, [ebp - 0xc08]
mov dword [ebp - 0xc08], 0x400
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0xc10]
push eax
push 0
push str.Password
push dword [ebp - 0xc0c]
call esi
push dword [ebp - 0xc0c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x434355
cmp dword [ebp - 0xc08], 1
jb 0x434355
push dword [ebp - 0xc08]
lea eax, [ebp - 0x404]
push eax
push edi
push str._s_:_Found_the_account__s__password__d
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0xc04]
push eax
push dword [ebp - 0xc08]
lea eax, [ebp - 0x804]
push eax
call fcn.0040c7de
add esp, 0x20
test eax, eax
je 0x434350
push 0xffffffffffffffff
mov edx, 0x66ae5d
lea eax, [ebp - 0xc04]
push edx
push eax
lea ecx, [ebp - 0x404]
push ecx
push edx
push edx
push 0x6d
push 3
call fcn.00412c85
add esp, 0x20
xor eax, eax
inc eax
jmp 0x434366
push esi
push edi
push str._s_:_RegQueryValueEx_failed_to_read_the_nimbuzz_password_value_or_it_is_empty__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.005fe955
leave
ret
Function at 0x434697
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f50
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x3eb]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x3e7
push esi
push 0
push eax
mov byte [ebp - 0x3ec], 0
call fcn.00626f50
push 0x1387
lea eax, [ebp - 0x1f43]
mov byte [ebp - 0x1f44], 0
push 0
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x7d3]
mov byte [ebp - 0x7d4], 0
push 0
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0xbbb]
mov byte [ebp - 0xbbc], 0
push 0
push eax
call fcn.00626f50
push edi
push str.SoftwarePaltalk_s
lea eax, [ebp - 0x1f44]
push 0x1388
push eax
call fcn.00445d6d
add esp, 0x40
lea eax, [ebp - 0x1f44]
mov esi, str.RecoverOldPaltakFromRegistry
push eax
push esi
push str._s_:_Recovering_from_registry_key__s
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x1f4c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x1f44]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x434783
push eax
lea eax, [ebp - 0x1f44]
push eax
push esi
push str._s_:_Failed_to_open_the_paltalk_account_key___s___Error0x_.8x
jmp 0x4348a2
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1f48]
push eax
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x1f48], 0x3e8
push eax
lea eax, [ebp - 0x1f50]
push eax
push 0
push str.nickname
push dword [ebp - 0x1f4c]
call esi
lea eax, [ebp - 0x1f48]
mov dword [ebp - 0x1f48], 0x3e8
push eax
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x1f50]
push eax
push 0
push 0x678bd8
push dword [ebp - 0x1f4c]
call esi
push dword [ebp - 0x1f4c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3ec]
push eax
call fcn.00631510
pop ecx
cmp eax, 1
jb 0x434896
lea eax, [ebp - 0x7d4]
push eax
call fcn.00631510
pop ecx
cmp eax, 1
jb 0x434896
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x3ec]
push eax
push edi
push str.RecoverOldPaltakFromRegistry
push str._s_:_Found_the_Platalk_account__s____s_:__s
call fcn.00449974
push 0x80
lea eax, [ebp - 0xbbc]
push eax
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x3ec]
push eax
push ebx
call fcn.0040cbb7
add esp, 0x28
test eax, eax
je 0x434884
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0xbbc]
push ecx
push eax
lea eax, [ebp - 0x3ec]
push eax
push ecx
push ecx
push 0x6b
push 3
call fcn.00412c85
add esp, 0x20
lea ecx, [ebp - 0x1f44]
push ecx
call fcn.00435a42
xor eax, eax
pop ecx
inc eax
jmp 0x4348ac
push esi
push edi
push str.RecoverOldPaltakFromRegistry
push str._s_:_Failed_to_read_the_paltalk_nick_pass_for_the_account__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x434b18
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7dc
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x7dc]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwareOpenVPN_GUIconfigs
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x434b67
push eax
push str.RecoverOpenVPNPasswords
push str._s_:_Failed_to_find_stored_entries_in_registry__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x434bf7
push esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7d8]
mov esi, ebx
push eax
lea eax, [ebp - 0x3ec]
push eax
push ebx
jmp 0x434bbf
lea eax, [ebp - 0x3ec]
push eax
push str.SoftwareOpenVPN_GUIconfigs_s
lea eax, [ebp - 0x7d4]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x7d4]
push eax
call fcn.004348bb
add esp, 0x14
lea eax, [ebp - 0x7d8]
inc esi
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x3ec]
push eax
push esi
push dword [ebp - 0x7dc]
mov dword [ebp - 0x7d8], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x434b7f
push str.RecoverOpenVPNPasswords
push str._s_:_RegEnumKeyEx_finished_listing_all_configs
call fcn.00449974
pop ecx
pop ecx
push dword [ebp - 0x7dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x435ffe
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x974
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x21b]
push 0x207
push ebx
push eax
mov byte [ebp - 0x21c], bl
call fcn.00626f50
mov esi, str.Opera_Software
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, str.RecoverPasswordFromOperaBrowsers
push esi
push str._s_Entered
call fcn.00449974
add esp, 0x14
lea eax, [ebp - 0x834]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x436075
push str._n_Failed_to_get_current_users_local_appdata_folder
call fcn.00449974
pop ecx
xor eax, eax
jmp 0x4361ea
lea eax, [ebp - 0x834]
mov edi, 0x208
push eax
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.006311ec
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.00631246
lea eax, [ebp - 0x21c]
push eax
push esi
push str._s_Final_UC_Browser_Root_path_is__s
call fcn.00449974
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x62c]
push edi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0x62c]
push edi
push eax
call fcn.00631246
lea eax, [ebp - 0x62c]
push eax
push str._n_Searching_for_Opera_Browser_profile_files_in_the_folder__s
call fcn.00449974
add esp, 0x44
lea eax, [ebp - 0x974]
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x43606e
mov ebx, str._s_sLogin_Data
test byte [ebp - 0x974], 0x10
je 0x4361ca
cmp byte [ebp - 0x948], 0x2e
je 0x4361ca
lea eax, [ebp - 0x948]
push eax
push str.RecoverPasswordFromOperaBrowsers
push str._s___Found_the_Directory___s
call fcn.00449974
lea eax, [ebp - 0x948]
push str.Opera_GX_Stable
push eax
call fcn.00631435
add esp, 0x14
test eax, eax
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
lea eax, [ebp - 0x424]
push edi
push eax
jne 0x436186
call fcn.00445d6d
lea eax, [ebp - 0x424]
push eax
push 0x43
call fcn.00415293
add esp, 0x1c
jmp 0x4361ca
call fcn.00445d6d
lea eax, [ebp - 0x424]
push eax
push 2
call fcn.00415293
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x21c]
push eax
push str._s_sDefaultLogin_Data
lea eax, [ebp - 0x424]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x424]
push eax
push 2
call fcn.00415293
add esp, 0x38
lea eax, [ebp - 0x974]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43610f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x437cab
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd08
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x3f7]
push esi
push edi
mov esi, 0x3e7
mov byte [ebp - 0x3f8], 0
push esi
push 0
push eax
call fcn.00626f50
push esi
lea eax, [ebp - 0x7df]
mov byte [ebp - 0x7e0], 0
push 0
push eax
call fcn.00626f50
mov esi, str.user.ini
lea edi, [ebp - 0x10]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00631510
add esp, 0x1c
test eax, eax
je 0x437d3f
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x66c218
lea eax, [ebp - 0x3f8]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3f8]
push eax
push dword [ebp + 8]
call fcn.00437ebe
add esp, 0x1c
jmp 0x437eaf
lea eax, [ebp - 0x7e0]
push eax
xor eax, eax
push eax
push eax
push 0x1c
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x437d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverPokerStarsPasswords
push 0x66d630
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x437eaf
mov esi, 0x2d0
cmp dword [ebp + 8], esi
jne 0x437dac
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x7e0]
push eax
push str._sFullTilt_s
lea eax, [ebp - 0x3f8]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3f8]
push eax
push esi
jmp 0x437d32
lea eax, [ebp - 0x7e0]
mov esi, 0x400
push eax
lea eax, [ebp - 0xbc8]
push esi
push eax
call fcn.006311ec
push 0x66d678
lea eax, [ebp - 0xbc8]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0xbc8]
mov edi, str.RecoverPokerStarsPasswords
push eax
push edi
push str._s_:__Searching_for_PokerStars_folders_in___s
call fcn.00449974
add esp, 0x24
lea eax, [ebp - 0xd08]
push eax
lea eax, [ebp - 0xbc8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x437e27
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_FindFirstFileA_failed_to_start_search_in_location__Error0x_.8x____s_
call fcn.00449974
add esp, 0x10
jmp 0x437d70
mov edi, str.PokerStars
test byte [ebp - 0xd08], 0x10
je 0x437e93
cmp byte [ebp - 0xcdc], 0x2e
je 0x437e93
push edi
call fcn.00631510
push eax
lea eax, [ebp - 0xcdc]
push edi
push eax
call fcn.006317d8
add esp, 0x10
test eax, eax
jne 0x437e93
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xcdc]
push eax
lea eax, [ebp - 0x7e0]
push eax
push 0x66d710
lea eax, [ebp - 0x3f8]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3f8]
push eax
push dword [ebp + 8]
call fcn.00437ebe
add esp, 0x20
lea eax, [ebp - 0xd08]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x437e2c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x43b96c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfa4
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, str.RecoverUltraVncPassword
push esi
push 0x66c4b8
call fcn.00449974
xor ebx, ebx
mov edi, 0x3e8
pop ecx
pop ecx
cmp dword [0x716864], ebx
je 0x43ba33
lea eax, [ebp - 0xbbc]
push eax
push ebx
push ebx
push 0x2a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x43b9d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s_Failed_to_find_program_files_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x43ba33
lea eax, [ebp - 0xbbc]
push eax
push esi
push str._s_x64___Found_Program_Files_path__s
call fcn.00449974
lea eax, [ebp - 0xbbc]
push eax
push str._sUltraVNCultravnc.ini
lea eax, [ebp - 0x3ec]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3ec]
push eax
call fcn.0043baed
lea eax, [ebp - 0xbbc]
push eax
push str._suvnc_bvbaUltraVNCultravnc.ini
lea eax, [ebp - 0x3ec]
push edi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3ec]
push eax
call fcn.0043baed
add esp, 0x34
mov esi, str.C:Program_Files
lea edi, [ebp - 0x7d4]
push 0x3d7
lea eax, [ebp - 0x7c3]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
add esp, 0xc
lea eax, [ebp - 0xfa4]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, byte [ebp - 0xfa4]
mov byte [ebp - 0x7d4], al
lea eax, [ebp - 0x7d4]
push eax
push str.RecoverUltraVncPassword
push str._s_xall___Found_Program_Files_path__s
call fcn.00449974
lea eax, [ebp - 0x7d4]
mov esi, 0x208
push eax
push str._sUltraVNCultravnc.ini
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3ec]
push eax
call fcn.0043baed
lea eax, [ebp - 0x7d4]
push eax
push str._suvnc_bvbaUltraVNCultravnc.ini
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x3ec]
push eax
call fcn.0043baed
mov ecx, dword [ebp - 4]
add esp, 0x34
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005fe955
leave
ret
Function at 0x43bdb7
Capabilities:
Gather southriver-webdrive information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xd
pop ecx
mov esi, str.SoftwareSouth_River_TechnologiesWebDriveConnections
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.RecoverWebDrivePasswords
push esi
push str._s_:_Started
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x814]
xor ebx, ebx
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x3c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43be2b
push eax
lea eax, [ebp - 0x3c]
push eax
push esi
push str._s_:_Failed_to_open_WebDrive_key__s_in_registry__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor eax, eax
jmp 0x43beb1
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x810]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x424]
mov esi, ebx
push eax
push ebx
jmp 0x43be8c
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x66c218
lea eax, [ebp - 0x80c]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x80c]
push eax
call fcn.0043bec0
add esp, 0x18
lea eax, [ebp - 0x810]
inc esi
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x424]
push eax
push esi
push dword [ebp - 0x814]
mov dword [ebp - 0x810], 0x3e8
call edi
test eax, eax
je 0x43be48
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret