joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415595
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ec
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x3eb]
push 0x3e7
push ebx
push eax
mov edi, edx
mov byte [ebp - 0x3ec], bl
mov esi, ecx
call fcn.006390b0
push esi
mov byte [edi], bl
call fcn.00643470
add esp, 0x10
test eax, eax
je 0x4155e8
xor byte [esi + ebx], 2
inc ebx
push esi
call fcn.00643470
pop ecx
cmp ebx, eax
jb 0x4155d8
push ecx
lea edx, [ebp - 0x3ec]
mov ecx, esi
call fcn.004020b3
pop ecx
test eax, eax
je 0x41561a
push ecx
mov edx, edi
lea ecx, [ebp - 0x3ec]
call fcn.004020b3
pop ecx
test eax, eax
je 0x41561a
push edi
call fcn.00643470
xor eax, eax
pop ecx
inc eax
jmp 0x41561c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret

Function at 0x41562b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x3eb]
push 0x3e7
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x3ec], bl
call fcn.006390b0
add esp, 0xc
mov byte [esi], bl
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push ebx
push str.SoftwareRimArtsB2Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41571d
lea eax, [ebp - 0x3f4]
mov edi, 0x3e8
push eax
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x3f4], edi
push eax
lea eax, [ebp - 0x3f8]
push eax
push ebx
push str.DataDir
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3ec]
push eax
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x41571d
lea eax, [ebp - 0x3ec]
push eax
call fcn.00643470
pop ecx
cmp byte [ebp + eax - 0x3ed], 0x5c
jne 0x415707
lea eax, [ebp - 0x3ec]
push eax
call fcn.00643470
dec eax
pop ecx
cmp eax, edi
jae 0x41572e
mov byte [ebp + eax - 0x3ec], bl
lea ecx, [ebp - 0x3ec]
push ecx
push edi
push esi
call fcn.006494f3
xor eax, eax
add esp, 0xc
inc eax
jmp 0x41571f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
call fcn.00612782
int3
Function at 0x415ca7
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10f8
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x3fb]
push esi
push edi
mov esi, 0x3e7
mov dword [ebp - 0x10f8], ecx
push esi
push 0
push eax
mov byte [ebp - 0x3fc], 0
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x7e4], 0
lea eax, [ebp - 0x7e3]
push esi
push 0
push eax
call fcn.006390b0
mov esi, str.Mailbox.ini
lea edi, [ebp - 0x14]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00643470
pop ecx
cmp eax, 1
jae 0x415d6f
lea ecx, [ebp - 0x7e4]
call fcn.0041562b
test eax, eax
lea eax, [ebp - 0x7e4]
push eax
jne 0x415d70
xor eax, eax
push eax
push eax
push 5
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x415d4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x415e71
lea eax, [ebp - 0x7e4]
mov esi, 0x3e8
push eax
push str._sBecky
lea eax, [ebp - 0x3fc]
push esi
push eax
call fcn.00402e0a
add esp, 0x10
jmp 0x415d85
push ebx
mov esi, 0x3e8
lea eax, [ebp - 0x3fc]
push esi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x3fc]
push eax
lea eax, [ebp - 0xbcc]
push esi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0xbcc]
push 0x6c7624
push esi
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0x10f4]
push eax
lea eax, [ebp - 0xbcc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x415d45
mov ebx, dword [ebp - 0x10f8]
test byte [ebp - 0x10f4], 0x10
je 0x415e51
lea eax, [ebp - 0x10c8]
push 0x6c94b4
push eax
call fcn.00650fe0
pop ecx
pop ecx
test eax, eax
je 0x415e51
lea eax, [ebp - 0x10c8]
push 0x6c94b8
push eax
call fcn.00650fe0
pop ecx
pop ecx
test eax, eax
je 0x415e51
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10c8]
push eax
lea eax, [ebp - 0x3fc]
push eax
push 0x6c63f4
lea eax, [ebp - 0xfb4]
push esi
push eax
call fcn.00402e0a
add esp, 0x18
lea ecx, [ebp - 0xfb4]
call fcn.00405670
test eax, eax
je 0x415e51
lea eax, [ebp - 0xfb4]
mov ecx, ebx
push eax
call fcn.00415734
lea ecx, [ebp - 0x10f4]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x415dd6
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4
Function at 0x4164f5
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e34
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x4e2c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x4e30]
mov edi, ecx
push eax
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_CredEnumerateA]
test eax, eax
jne 0x41653a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x41661e
mov esi, ebx
cmp dword [ebp - 0x4e30], ebx
jbe 0x416607
mov eax, dword [ebp - 0x4e2c]
mov byte [ebp - 0x2718], bl
mov byte [ebp - 0x4e28], bl
mov eax, dword [eax + esi*4]
cmp dword [eax + 4], 1
jne 0x4165fa
push str.Microsoft_WinInet_www.google.com:
call fcn.00643470
pop ecx
push eax
mov eax, dword [ebp - 0x4e2c]
push str.Microsoft_WinInet_www.google.com:
mov eax, dword [eax + esi*4]
push dword [eax + 8]
call fcn.0065106c
add esp, 0xc
test eax, eax
jne 0x4165fa
mov eax, dword [ebp - 0x4e2c]
mov eax, dword [eax + esi*4]
cmp dword [eax + 0x1c], ebx
je 0x4165fa
cmp dword [eax + 0x18], ebx
je 0x4165fa
lea ecx, [ebp - 0x2718]
push ecx
lea ecx, [ebp - 0x4e28]
push ecx
push dword [eax + 0x18]
push dword [eax + 0x1c]
call fcn.00412668
push 0xffffffffffffffff
test eax, eax
je 0x4165d9
mov ecx, 0x6c5bb9
lea eax, [ebp - 0x2718]
push ecx
push eax
lea eax, [ebp - 0x4e28]
push eax
push ecx
jmp 0x4165e7
mov eax, 0x6c5bb9
mov ecx, str._Password_cannot_be_recovered_
push eax
push ecx
push ecx
push eax
push str.Gmail
push 0x106
push 2
mov ecx, edi
call fcn.0043ee6b
inc esi
cmp esi, dword [ebp - 0x4e30]
jb 0x416548
cmp dword [ebp - 0x4e2c], ebx
je 0x41661b
push dword [ebp - 0x4e2c]
call dword [sym.imp.ADVAPI32.dll_CredFree]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret

Function at 0x41662d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
xor edx, edx
mov dword [ebp - 4], 0x31ca3289
push edi
mov edi, ecx
mov byte [esi], 0
test ebx, ebx
je 0x416665
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
xor al, 0x30
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x41664d
pop edi
mov byte [edx + esi], 0
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x41693b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x7fc]
push edi
push eax
push 0x20019
xor ebx, ebx
mov dword [ebp - 0x800], ecx
push ebx
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x416980
xor eax, eax
jmp 0x416a0b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7f8]
mov edi, ebx
push eax
lea eax, [ebp - 0x7f4]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x4169e6
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x6c643c
lea eax, [ebp - 0x3f4]
push 0x3e8
push eax
call fcn.00402e0a
mov ecx, dword [ebp - 0x800]
lea eax, [ebp - 0x3f4]
add esp, 0x14
push eax
call fcn.00416671
inc edi
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x7f8]
push eax
lea eax, [ebp - 0x7f4]
push eax
push edi
push dword [ebp - 0x7fc]
mov dword [ebp - 0x7f8], 0x400
call ebx
test eax, eax
je 0x41699d
push dword [ebp - 0x7fc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4

Function at 0x416a1c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
mov ebx, ecx
lea eax, [ebp - 0x818]
pop ecx
push eax
mov esi, str.SoftwareIncrediMailIdentities
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
push 0x20019
xor edi, edi
lea eax, [ebp - 0x24]
push edi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416b30
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x814]
mov esi, edi
push eax
lea eax, [ebp - 0x810]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x416b0a
cmp byte [ebp - 0x810], 0x7b
jne 0x416af4
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x24]
push eax
push str._s_sAccounts_New
lea eax, [ebp - 0x410]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x410]
mov ecx, ebx
push eax
call fcn.0041693b
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x24]
push eax
push str._s_sAccounts
lea eax, [ebp - 0x410]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x410]
mov ecx, ebx
push eax
call fcn.0041693b
inc esi
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x810]
push eax
push esi
push dword [ebp - 0x818]
mov dword [ebp - 0x814], 0x400
call edi
test eax, eax
je 0x416a87
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x416b3f
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x22b]
push esi
push edi
push 0x207
push 0
push eax
mov byte [ebp - 0x22c], 0
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x24]
mov esi, str.Opera_MailOpera_Mailwand.dat
lea eax, [ebp - 0x22c]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push eax
xor eax, eax
push eax
push eax
movsw word es:[edi], word [esi]
push 0x1a
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x416bb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0x6c643c
lea eax, [ebp - 0x434]
push 0x208
push eax
call fcn.00402e0a
add esp, 0x14
lea ecx, [ebp - 0x434]
call fcn.00405670
test eax, eax
je 0x416ba3
lea eax, [ebp - 0x434]
push eax
push 0x3e8
push ebx
call fcn.006494f3
xor eax, eax
add esp, 0xc
inc eax
jmp 0x416ba5
Function at 0x4171f5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
push esi
mov byte [edi], 0
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x4172f7
push ebx
push esi
push 0x3e8
push edi
call fcn.006494f3
push edi
mov ebx, edi
mov esi, edi
call fcn.00643470
add esp, 0x10
movzx eax, byte [esi]
inc esi
mov cl, byte [eax + 0x6d0a78]
cmp cl, 0xff
je 0x4172b0
cmp cl, 0xfe
je 0x417228
cmp cl, 0x41
ja 0x4172b0
movzx eax, byte [esi]
inc esi
mov dl, byte [eax + 0x6d0a78]
cmp dl, 0xff
je 0x4172b0
cmp dl, 0xfe
je 0x417241
cmp dl, 0x41
ja 0x4172b0
mov al, dl
shl cl, 2
shr al, 4
or al, cl
mov byte [ebx], al
inc ebx
movzx eax, byte [esi]
inc esi
mov cl, byte [eax + 0x6d0a78]
cmp cl, 0xff
je 0x4172b0
cmp cl, 0xfe
je 0x417267
cmp cl, 0x41
ja 0x4172b0
mov al, cl
shl dl, 4
shr al, 2
or dl, al
mov byte [ebx], dl
inc ebx
movzx eax, byte [esi]
inc esi
mov al, byte [eax + 0x6d0a78]
cmp al, 0xff
je 0x4172b0
cmp al, 0xfe
je 0x41728d
cmp al, 0x41
ja 0x4172b0
shl cl, 6
or cl, al
mov byte [ebx], cl
inc ebx
jmp 0x417228
mov byte [ebx], 0
sub ebx, edi
push ebx
call fcn.0064f743
mov ebx, eax
push edi
mov esi, ebx
call fcn.00643470
pop ecx
pop ecx
lea ecx, [edi - 1]
add ecx, eax
jmp 0x4172da
mov al, byte [ecx]
cmp al, 0xfe
jae 0x4172de
xor al, 0x5a
mov byte [esi], al
inc esi
dec ecx
cmp ecx, edi
jae 0x4172ce
push ebx
push 0x3e8
push edi
mov byte [esi], 0
call fcn.006494f3
push ebx
call fcn.006434fb
add esp, 0x10
pop ebx
pop edi
pop esi
ret
Function at 0x41782b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x107]
push 0x103
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x108], bl
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x41789f
lea eax, [ebp - 0x108]
push eax
push str._sThe_Bat_
push 0x208
push esi
call fcn.00402e0a
add esp, 0x10
mov ecx, esi
call fcn.004055eb
test eax, eax
je 0x41789f
xor eax, eax
inc eax
jmp 0x4178a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x418594
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd08
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov ebx, 0x3e8
lea eax, [ebp - 0x7dc]
push ebx
push eax
mov edi, ecx
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0x3f4]
push ebx
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x3f4]
push 0x6c7624
push ebx
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0xd04]
push eax
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x418677
test byte [ebp - 0xd04], 0x10
je 0x41865e
cmp byte [ebp - 0xcd8], 0x2e
je 0x41865e
lea eax, [ebp - 0xcd8]
push eax
lea eax, [ebp - 0x7dc]
push eax
push str._s_sAccountsAccount.rec0
lea eax, [ebp - 0xbc4]
push ebx
push eax
call fcn.00402e0a
add esp, 0x14
lea ecx, [ebp - 0xbc4]
call fcn.00405670
test eax, eax
je 0x41865e
lea eax, [ebp - 0xbc4]
mov ecx, edi
push eax
call fcn.00417ba2
lea eax, [ebp - 0xd04]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41860c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4

Function at 0x418688
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd08
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov ebx, 0x3e8
lea eax, [ebp - 0x7dc]
push ebx
push eax
mov edi, ecx
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0x3f4]
push ebx
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x3f4]
push 0x6c7624
push ebx
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0xd04]
push eax
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x418772
test byte [ebp - 0xd04], 0x10
je 0x418759
cmp byte [ebp - 0xcd8], 0x2e
je 0x418759
lea eax, [ebp - 0xcd8]
push eax
lea eax, [ebp - 0x7dc]
push eax
push str._s_sAccount.stg
lea eax, [ebp - 0xbc4]
push ebx
push eax
call fcn.00402e0a
add esp, 0x14
lea ecx, [ebp - 0xbc4]
call fcn.00405670
test eax, eax
je 0x418759
lea eax, [ebp - 0xbc4]
mov ecx, edi
push eax
lea eax, [ebp - 0xcd8]
push eax
call fcn.00418090
lea eax, [ebp - 0xd04]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418700
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4
Function at 0x418783
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3eb]
push edi
xor ebx, ebx
push 0x3e7
push ebx
push eax
mov byte [ebp - 0x3ec], bl
call fcn.006390b0
add esp, 0xc
mov byte [esi], bl
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push ebx
push str.SoftwareAerofoxFoxmailPreview
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x418858
lea eax, [ebp - 0x3f4]
mov edi, 0x3e8
push eax
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x3f4], edi
push eax
lea eax, [ebp - 0x3f8]
push eax
push ebx
push str.Executable
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x3f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3ec]
push eax
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x418858
lea eax, [ebp - 0x3ec]
push 0x5c
push eax
call fcn.00639770
pop ecx
pop ecx
test eax, eax
je 0x418842
mov byte [eax], bl
lea ecx, [ebp - 0x3ec]
push ecx
push edi
push esi
call fcn.006494f3
xor eax, eax
add esp, 0xc
inc eax
jmp 0x41885a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 8
Function at 0x418b17
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x14], 0xce680f98
mov esi, ecx
mov dword [ebp - 0x10], 0x474c4377
push edi
push esi
mov dword [ebp - 0xc], 0x820ee9f9
mov dword [ebp - 8], 0xeb4c6bf4
mov dword [ebp - 0x34], 0x3085e035
mov dword [ebp - 0x30], 0xa3916d8a
mov dword [ebp - 0x2c], 0x37f25f96
mov dword [ebp - 0x28], 0x36cfd195
mov dword [ebp - 0x24], 0x5b7ede71
mov dword [ebp - 0x20], 0xfbd53862
mov dword [ebp - 0x1c], 0x4ba664db
mov dword [ebp - 0x18], 0x53055ad3
mov byte [ebx], 0
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x418ca2
push ecx
lea edx, [ebp - 0x41c]
mov ecx, esi
call fcn.004020b3
mov edi, eax
pop ecx
test edi, edi
je 0x418ca2
push esi
call fcn.00643470
push 0x20
pop eax
push eax
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x448], 0x208
push eax
mov dword [ebp - 0x444], 0x6610
call fcn.00638b30
add esp, 0x10
lea eax, [ebp - 0x454]
push 0xf0000000
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x418c9c
lea eax, [ebp - 0x44c]
push eax
push 0
push 0
push 0x2c
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x454]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x418c9c
push 0
lea eax, [ebp - 0x14]
push eax
push 1
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x418c9c
lea eax, [ebp - 0x450]
mov dword [ebp - 0x450], edi
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
push 1
push 0
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x418c9c
mov ecx, dword [ebp - 0x450]
mov eax, 0x3e8
cmp ecx, eax
jae 0x418cb3
push ecx
mov byte [ebp + ecx - 0x41c], 0
lea ecx, [ebp - 0x41c]
push ecx
push eax
push ebx
call fcn.00650b7d
xor eax, eax
add esp, 0x10
inc eax
jmp 0x418ca4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
call fcn.00612782
int3
Function at 0x4192b9
Capabilities:
Encode data using xor

Disassembly:
push 0x594
mov eax, 0x66d20e
call fcn.00612b19
mov dword [ebp - 0x594], edx
mov dword [ebp - 0x598], ecx
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x588]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x58c], eax
lea eax, [ebp - 0x508]
mov dword [ebp - 0x5a0], edi
mov dword [ebp - 0x590], 0x20
mov dword [ebp - 0x4c8], eax
call fcn.0044c2c4
and dword [ebp - 4], 0
mov ebx, 0x1000
push ebx
call fcn.004dfd44
push ebx
mov dword [ebp - 0x444], eax
call fcn.004dfd44
push ebx
mov dword [ebp - 0x440], eax
call fcn.004dfd44
push ebx
mov dword [ebp - 0x43c], eax
call fcn.004dfd44
xor ebx, ebx
mov dword [ebp - 0x438], eax
inc ebx
add esp, 0x10
cmp dword [ebp + 0x18], ebx
jl 0x419490
test edi, edi
je 0x419490
cmp edi, 0xc8
ja 0x419490
push edi
lea eax, [ebp - 0x434]
push esi
push eax
call fcn.00638b30
mov ecx, ebx
lea edx, [edi + 4]
add esp, 0xc
mov dword [ebp - 0x59c], ecx
mov eax, ecx
mov byte [ebp + edi - 0x431], cl
sar eax, 0x18
mov byte [ebp + edi - 0x434], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp + edi - 0x433], al
mov eax, ecx
sar eax, 8
lea ecx, [ebp - 0x588]
mov byte [ebp + edi - 0x432], al
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x594]
lea eax, [ebp - 0x434]
push dword [ebp - 0x598]
push edx
push eax
call fcn.004468a2
push 0x14
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00638b30
mov eax, dword [ebp + 0x18]
add esp, 0xc
cmp eax, ebx
jle 0x41943f
mov edi, dword [ebp - 0x594]
lea esi, [eax - 1]
mov ebx, dword [ebp - 0x598]
lea eax, [ebp - 0x4c]
push eax
push edi
push ebx
push 0x14
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x588]
call fcn.004468a2
push 0x14
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00638b30
add esp, 0xc
xor ecx, ecx
mov al, byte [ebp + ecx - 0x24]
xor byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0x14
jb 0x419423
sub esi, 1
jne 0x4193f8
mov edi, dword [ebp - 0x5a0]
xor ebx, ebx
inc ebx
push 0x14
pop esi
cmp dword [ebp - 0x590], esi
lea eax, [ebp - 0x38]
cmovb esi, dword [ebp - 0x590]
push esi
push eax
push dword [ebp - 0x58c]
call fcn.00638b30
mov eax, dword [ebp - 0x590]
lea edx, [edi + 4]
mov ecx, dword [ebp - 0x59c]
sub eax, esi
add dword [ebp - 0x58c], esi
add esp, 0xc
inc ecx
mov dword [ebp - 0x590], eax
mov dword [ebp - 0x59c], ecx
test eax, eax
jne 0x419382
jmp 0x419492
xor ebx, ebx
lea ecx, [ebp - 0x588]
call fcn.00408865
mov eax, ebx
call fcn.00612ac8
ret