joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c15c
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x974
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x207
lea eax, [ebp - 0x217]
mov byte [ebp - 0x218], 0
push 0
push eax
mov ebx, ecx
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x10]
mov esi, str.UCBrowser
lea eax, [ebp - 0x628]
push eax
movsd dword es:[edi], dword [esi]
xor eax, eax
push eax
push eax
push 0x1c
movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x40c292
lea eax, [ebp - 0x628]
mov edi, 0x208
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x6c7624
push edi
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c292
test byte [ebp - 0x970], 0x10
je 0x40c274
cmp byte [ebp - 0x944], 0x2e
je 0x40c274
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x218]
push eax
push str._s_sDefault
lea eax, [ebp - 0x830]
push edi
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x830]
mov ecx, ebx
push eax
call fcn.0040c012
lea eax, [ebp - 0x970]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c231
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x40c294
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x40cacc
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ec
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 0x3eb]
push 0x3e7
push ebx
push eax
mov edi, ecx
mov byte [ebp - 0x3ec], bl
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0x3ec]
push eax
push ebx
push ebx
push 0x2a
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call ebx
test eax, eax
jns 0x40cb20
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40cb5a
push str.plutil
push str.upport
push str.pplication_S
push str.Apple_A
lea eax, [ebp - 0x3ec]
push eax
push str._sSafari_s_s_s_s.exe
push 0x3e8
push edi
call fcn.00402e0a
add esp, 0x20
mov ecx, edi
call fcn.00405670
cmp eax, 1
je 0x40cbb5
lea eax, [ebp - 0x3ec]
push eax
xor eax, eax
push eax
push eax
push 0x2c
push eax
call ebx
test eax, eax
jns 0x40cb78
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x40cbb8
push str.plutil
push str.upport
push str.pplication_S
push str.Apple_A
lea eax, [ebp - 0x3ec]
push eax
push str._sSafari_s_s_s_s.exe
push 0x3e8
push edi
call fcn.00402e0a
add esp, 0x20
mov ecx, edi
call fcn.00405670
dec eax
neg eax
sbb eax, eax
inc eax
jmp 0x40cbb8
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x40cbc6
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
lea ecx, [ebp - 0x804]
call fcn.0040cacc
test eax, eax
je 0x40cd09
lea eax, [ebp - 0x41c]
mov ebx, 0x208
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
cdq
mov ecx, 0x2710
idiv ecx
lea eax, [ebp - 0x41c]
push edx
push eax
push str._stmp_xsprc_test__d.ini
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x214]
push esi
push eax
push str.xml1
push str._convert
lea eax, [ebp - 0x804]
push eax
push str.__s___s__s__s__o___s____s_
lea eax, [ebp - 0xbec]
push 0x3e8
push eax
call fcn.00402e0a
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0xc44]
push ebx
push eax
call fcn.006390b0
add esp, 0x2c
mov dword [ebp - 0xc44], esi
xor eax, eax
mov dword [ebp - 0xc18], 1
mov word [ebp - 0xc14], ax
lea eax, [ebp - 0xbfc]
push eax
lea eax, [ebp - 0xc44]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xbec]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40cd09
push 0xffffffffffffffff
push dword [ebp - 0xbfc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xbf8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xbfc]
call esi
lea ecx, [ebp - 0x214]
call fcn.00405670
test eax, eax
je 0x40cd09
lea ecx, [ebp - 0x214]
push ecx
mov ecx, edi
call fcn.0040c517
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
inc eax
jmp 0x40cd11
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4

Function at 0x40cd22
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f8
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10f]
push 0x103
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x110], bl
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x40cdce
push str.plist
push str.hain.
push str.keyc
push str.rences
push str.terPrefe
push str.e_Compu
push str.Appl
lea eax, [ebp - 0x110]
push eax
push str._s_s_s_s_s_s_s_s
lea eax, [ebp - 0x4f8]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x2c
lea ecx, [ebp - 0x4f8]
call fcn.00405670
test eax, eax
je 0x40cdce
lea eax, [ebp - 0x4f8]
mov ecx, esi
push eax
call fcn.0040cbc6
jmp 0x40cdd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x40d5a0
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x9c54
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x9c4c]
mov ebx, ecx
push eax
lea eax, [ebp - 0x9c50]
push eax
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CredEnumerateA]
test eax, eax
jne 0x40d5e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x40d768
xor esi, esi
cmp dword [ebp - 0x9c50], esi
jbe 0x40d750
mov eax, dword [ebp - 0x9c4c]
mov byte [ebp - 0x2718], 0
mov byte [ebp - 0x4e28], 0
mov eax, dword [eax + esi*4]
cmp dword [eax + 4], 1
jne 0x40d743
push str.Microsoft_WinInet_
call fcn.00643470
pop ecx
push eax
mov eax, dword [ebp - 0x9c4c]
push str.Microsoft_WinInet_
mov eax, dword [eax + esi*4]
push dword [eax + 8]
call fcn.0065106c
add esp, 0xc
test eax, eax
jne 0x40d743
mov eax, dword [ebp - 0x9c4c]
mov eax, dword [eax + esi*4]
cmp dword [eax + 0x1c], 0
je 0x40d743
cmp dword [eax + 0x18], 0
je 0x40d743
push dword [eax + 8]
lea eax, [ebp - 0x7538]
push 0x2710
push eax
call fcn.006494f3
mov eax, dword [ebp - 0x9c4c]
add esp, 0xc
mov eax, dword [eax + esi*4]
push 0x2f
push dword [eax + 8]
call fcn.006393d0
pop ecx
pop ecx
test eax, eax
je 0x40d691
mov byte [eax], 0
mov eax, dword [ebp - 0x9c4c]
push str.:443
mov eax, dword [eax + esi*4]
push dword [eax + 8]
call fcn.00639500
mov edi, str.https:___s
pop ecx
pop ecx
push str.Microsoft_WinInet_
test eax, eax
jne 0x40d6bc
mov edi, str.http:___s
call fcn.00643470
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x9c4c]
mov eax, dword [eax + esi*4]
add ecx, dword [eax + 8]
lea eax, [ebp - 0x9c48]
push ecx
push edi
push 0x2710
push eax
call fcn.00402e0a
mov eax, dword [ebp - 0x9c4c]
lea ecx, [ebp - 0x2718]
add esp, 0x10
mov eax, dword [eax + esi*4]
push ecx
lea ecx, [ebp - 0x4e28]
push ecx
push dword [eax + 0x18]
push dword [eax + 0x1c]
call fcn.00412668
test eax, eax
mov ecx, ebx
push 3
lea eax, [ebp - 0x7538]
push eax
je 0x40d727
lea eax, [ebp - 0x2718]
push eax
lea eax, [ebp - 0x4e28]
push eax
jmp 0x40d72e
mov edi, str._Password_cannot_be_recovered_
push edi
push edi
lea eax, [ebp - 0x9c48]
push eax
push 0x6c5bb9
push 0
push 1
call fcn.0043ee6b
inc esi
cmp esi, dword [ebp - 0x9c50]
jb 0x40d5f3
cmp dword [ebp - 0x9c4c], 0
je 0x40d765
push dword [ebp - 0x9c4c]
call dword [sym.imp.ADVAPI32.dll_CredFree]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x41081b
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e34
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
cmp eax, 1
jae 0x410845
xor eax, eax
jmp 0x41087f
dec eax
push ebx
mov dword [ebp - 0x4e34], eax
xor ebx, ebx
lea eax, [ecx + 1]
mov dword [ebp - 0x4e30], eax
lea eax, [ebp - 0x4e2c]
push eax
push 1
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4e34]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x41088e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.006122f0
leave
ret 0x14
push dword [ebp - 0x4e2c]
lea eax, [ebp - 0x4e24]
push dword [ebp - 0x4e28]
push eax
call fcn.00638b30
mov eax, dword [ebp - 0x4e2c]
add esp, 0xc
and eax, 0xfffffffe
cmp eax, 0x4e20
jae 0x410914
xor ecx, ecx
mov word [ebp + eax - 0x4e24], cx
lea eax, [ebp - 0x4e24]
push eax
call fcn.00648cfd
pop ecx
push ebx
push ebx
push 0x2710
lea eax, [ebp - 0x4e24]
push esi
push eax
call fcn.00648cfd
pop ecx
push eax
lea eax, [ebp - 0x4e24]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x4e24]
push ecx
call fcn.00648cfd
push esi
mov byte [eax + esi], bl
call fcn.00643470
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x41087e
call fcn.00612782
int3
Function at 0x412503
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 9
pop ecx
mov esi, str.abe2869f_9b47_4cd9_a358_c22904dba7f7
mov edx, dword [ebp + 0xc]
lea edi, [ebp - 0x2c]
mov ebx, dword [ebp + 0x14]
rep movsd dword es:[edi], dword [esi]
push 9
pop ecx
movsb byte es:[edi], byte [esi]
mov esi, str.82BD0E67_9FEA_4748_8672_D5EFE5B779B0
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
movsx ax, byte [ebp + ecx - 0x2c]
shl ax, 2
mov word [ebp + ecx*2 - 0xa8], ax
movsx ax, byte [ebp + ecx - 0x54]
shl ax, 2
mov word [ebp + ecx*2 - 0xf8], ax
inc ecx
cmp ecx, 0x25
jb 0x41253d
mov ecx, dword [ebp + 8]
cmp ecx, 1
jne 0x412577
lea eax, [ebp - 0xa8]
jmp 0x412582
cmp ecx, 4
jne 0x412592
lea eax, [ebp - 0xf8]
mov dword [ebp - 0x108], 0x4a
mov dword [ebp - 0x104], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], eax
cmp ecx, 1
je 0x4125bb
cmp ecx, 4
je 0x4125bb
lea eax, [ebp - 0x100]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4125cf
lea eax, [ebp - 0x100]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x108]
push eax
push ecx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x4125ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x412657
mov eax, dword [ebp - 0x100]
mov ecx, dword [ebp - 0xfc]
cmp eax, 2
jb 0x412625
cmp byte [ecx + 1], 0
jne 0x412625
xor edx, edx
shr eax, 1
push edx
push edx
push 0x2710
push ebx
push eax
push ecx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x100]
shr eax, 1
mov byte [eax + ebx], 0
jmp 0x41263f
push eax
push ecx
push 0x2710
push ebx
call fcn.00650b7d
mov eax, dword [ebp - 0x100]
add esp, 0x10
mov byte [ebx + eax], 0
cmp dword [ebp - 0xfc], 0
je 0x412654
push dword [ebp - 0xfc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 0x10
Function at 0x412668
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x27ac
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
lea edi, [ebp - 0x2c]
push 9
mov edx, dword [ebp + 8]
mov esi, str.abe2869f_9b47_4cd9_a358_c22904dba7f7
mov ebx, dword [ebp + 0x10]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2794], eax
xor ecx, ecx
movsb byte es:[edi], byte [esi]
movsx ax, byte [ebp + ecx - 0x2c]
shl ax, 2
mov word [ebp + ecx*2 - 0x80], ax
inc ecx
cmp ecx, 0x25
jb 0x4126a1
lea eax, [ebp - 0x80]
mov dword [ebp - 0x27a4], 0x4a
mov dword [ebp - 0x27a0], eax
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x27ac], eax
lea eax, [ebp - 0x279c]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x27a4]
mov dword [ebp - 0x27a8], edx
push eax
push ecx
lea eax, [ebp - 0x27ac]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x41270a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x412791
xor ecx, ecx
lea eax, [ebp - 0x2790]
push ecx
push ecx
mov edi, 0x2710
push edi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x2798]
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x2790]
push 0x3a
push eax
call fcn.006393d0
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x2790]
push eax
push edi
push ebx
test esi, esi
je 0x412768
mov byte [esi], 0
call fcn.006494f3
lea eax, [esi + 1]
push eax
mov eax, dword [ebp - 0x2794]
push edi
push eax
call fcn.006494f3
add esp, 0x18
jmp 0x412779
call fcn.006494f3
mov eax, dword [ebp - 0x2794]
add esp, 0xc
mov byte [eax], 0
cmp dword [ebp - 0x2798], 0
je 0x41278e
push dword [ebp - 0x2798]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 0x10
Function at 0x414597
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd04
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x7d8]
push edi
mov esi, 0x400
mov ebx, ecx
push esi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x7d8]
push 0x6c7624
push esi
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0xd00]
push eax
lea eax, [ebp - 0x7d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4146a6
test byte [ebp - 0xd00], 0x10
jne 0x414689
lea eax, [ebp - 0xcd4]
push eax
lea eax, [ebp - 0x3f0]
push 0x3e8
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x3f0]
push eax
call fcn.00643470
pop ecx
inc eax
push eax
lea eax, [ebp - 0x3f0]
push eax
call fcn.0064ffd4
lea eax, [ebp - 0x3f0]
push str..oeaccount
push eax
call fcn.00639500
add esp, 0x10
test eax, eax
je 0x414689
lea eax, [ebp - 0xcd4]
push eax
push edi
push 0x6c643c
lea eax, [ebp - 0xbc0]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0xbc0]
mov ecx, ebx
push eax
push dword [ebp + 8]
call fcn.004132e2
lea eax, [ebp - 0xd00]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4145fc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 8
Function at 0x4146b7
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
push 0x3ff
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x403]
push ebx
push eax
mov dword [ebp - 0x414], ecx
mov byte [ebp - 0x404], bl
call fcn.006390b0
mov eax, dword [ebp - 0x414]
add esp, 0xc
mov dword [eax + 0x5bc70], ebx
add eax, 0x5b888
mov dword [ebp - 0x41c], eax
mov byte [eax], bl
lea eax, [ebp - 0x40c]
push eax
push 0x20019
push ebx
push esi
push SysReAllocString
mov byte [edi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4148ec
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x41c]
lea eax, [ebp - 0x420]
mov dword [ebp - 0x408], 0x3e8
push eax
push ebx
push str.Salt
push dword [ebp - 0x40c]
call esi
test eax, eax
jne 0x414795
mov ecx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x408]
push dword [ebp - 0x410]
mov dword [ecx + 0x5bc70], eax
call fcn.00643470
pop ecx
cmp eax, 1
jae 0x4147a8
inc ebx
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x4148ee
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0x400
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push str.Store_Root
push dword [ebp - 0x40c]
call esi
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x404]
push eax
call fcn.00643470
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
cmp eax, 1
jbe 0x414844
lea eax, [ebp - 0x418]
push eax
push 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x414842
push 0x3e8
push edi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
test eax, eax
jne 0x414834
call esi
mov byte [edi], bl
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x414844
call esi
push edi
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x41485f
mov ecx, edi
call fcn.004055eb
test eax, eax
jne 0x4148e5
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x4148ea
push dword [ebp - 0x410]
lea eax, [ebp - 0x404]
push eax
push 0x6c643c
push 0x3e8
push edi
call fcn.00402e0a
add esp, 0x14
mov ecx, edi
call fcn.004055eb
test eax, eax
jne 0x4148e5
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x4148ea
push dword [ebp - 0x410]
lea eax, [ebp - 0x404]
push eax
push 0x6c643c
push 0x3e8
push edi
call fcn.00402e0a
add esp, 0x14
mov ecx, edi
call fcn.004055eb
neg eax
sbb eax, eax
neg eax
jmp 0x4148ee
xor eax, eax
inc eax
jmp 0x4148ee
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 0x10
Function at 0x4148ff
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10ec
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
push edi
mov dword [ebp - 0x10ec], eax
call fcn.00643470
pop ecx
push ecx
cmp eax, 1
mov ecx, esi
lea eax, [ebp - 0x3f0]
push eax
jae 0x41495b
push dword [ebp - 0x10ec]
push ebx
call fcn.004146b7
test eax, eax
je 0x414b1c
mov ebx, 0x3e8
jmp 0x414989
push 0x6c5bb9
push ebx
call fcn.004146b7
cmp dword [esi + 0x5bc70], 1
jb 0x414b1c
push edi
mov ebx, 0x3e8
lea eax, [ebp - 0x3f0]
push ebx
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x3f0]
push eax
call fcn.00643470
pop ecx
cmp byte [ebp + eax - 0x3f1], 0x5c
jne 0x4149be
lea eax, [ebp - 0x3f0]
push eax
call fcn.00643470
dec eax
pop ecx
cmp eax, ebx
jae 0x414b2f
mov byte [ebp + eax - 0x3f0], 0
lea eax, [ebp - 0x3f0]
mov edi, 0x400
push eax
lea eax, [ebp - 0xfa8]
push edi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0xfa8]
push 0x6c7624
push edi
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0x10e8]
push eax
lea eax, [ebp - 0xfa8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x414b1c
lea eax, [ebp - 0x10bc]
push 0x6c94b4
push eax
call fcn.00650fe0
pop ecx
pop ecx
test eax, eax
je 0x414afa
lea eax, [ebp - 0x10bc]
push 0x6c94b8
push eax
call fcn.00650fe0
pop ecx
pop ecx
test eax, eax
je 0x414afa
test byte [ebp - 0x10e8], 0x10
lea eax, [ebp - 0x10bc]
push eax
jne 0x414acd
lea eax, [ebp - 0x7d8]
push ebx
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x7d8]
push eax
call fcn.00643470
pop ecx
inc eax
push eax
lea eax, [ebp - 0x7d8]
push eax
call fcn.0064ffd4
lea eax, [ebp - 0x7d8]
push str..oeaccount
push eax
call fcn.00639500
add esp, 0x10
test eax, eax
je 0x414afa
lea eax, [ebp - 0x10bc]
push eax
lea eax, [ebp - 0x3f0]
push eax
push 0x6c643c
lea eax, [ebp - 0xbc0]
push ebx
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0xbc0]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.004132e2
jmp 0x414afa
lea eax, [ebp - 0x3f0]
push eax
push 0x6c643c
lea eax, [ebp - 0xbc0]
push ebx
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0xbc0]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.00414597
lea ecx, [ebp - 0x10e8]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414a0e
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x414b1e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 0x10
call fcn.00612782
int3
Function at 0x414be5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], 0x2a9a
mov ebx, ecx
push ebx
mov byte [edi], 0
call fcn.00643470
pop ecx
shr eax, 1
push 0
mov dword [ebp - 0xc], eax
pop esi
je 0x414c4c
lea eax, [ebp - 8]
push eax
push str._02X
push ebx
call fcn.00404468
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp - 8]
add ebx, 2
sar ecx, 8
xor cl, al
add eax, dword [ebp - 4]
imul eax, eax, 0x7ebf
mov byte [esi + edi], cl
mov ecx, 0x3171
sub ecx, eax
inc esi
movzx eax, cx
mov dword [ebp - 4], eax
cmp esi, dword [ebp - 0xc]
jl 0x414c0d
mov byte [esi + edi], 0
pop edi
pop esi
pop ebx
leave
ret