joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41218d
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x26e0]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], 6
cmp dword [eax + 4], 1
je 0x412201
cmp dword [edi + 0x2480], 0
je 0x41222f
push dword [esi + 0xc]
and dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
push eax
push dword [edi + 0x2484]
push dword [edi + 0x2480]
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4121ef
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x41222f
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x3e5
neg eax
sbb eax, eax
inc eax
jmp 0x412232
cmp dword [esi], 0
jne 0x412212
mov eax, dword [esi + 4]
test eax, eax
je 0x412212
mov dword [esi + 0x18], eax
jmp 0x41222f
push 1
push ebx
mov ecx, edi
mov dword [esi + 0x28], 4
call fcn.00412e42
test eax, eax
jne 0x41222f
push ebx
mov ecx, edi
call fcn.0041296e
push 1
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x412501
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 0x26e0]
push ebx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov esi, dword [eax + ecx*4]
push 0x28
pop ebx
lea edi, [esi + 0x8044]
push ebx
push 0
push edi
call sub.MSVCRT.dll_memset
mov dword [edi], ebx
mov edi, 0x8000
lea ebx, [esi + 0x40]
push edi
push 0
push ebx
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 0x8040]
mov dword [esi + 0x8058], ebx
lea ebx, [esi + 0x805c]
add esp, 0x18
test eax, eax
mov dword [ebx], edi
je 0x412586
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
sub ecx, dword [eax + 0x18]
sbb edx, dword [eax + 0x1c]
sub ecx, dword [eax + 8]
sbb edx, dword [eax + 0xc]
add ecx, 1
mov eax, edx
adc eax, 0
ja 0x412579
cmp ecx, edi
jbe 0x41257f
and dword [ebp - 8], 0
jmp 0x4125bb
mov edi, ecx
mov dword [ebp - 8], eax
jmp 0x4125bb
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5d108]
mov edx, dword [eax + 0x5d10c]
cmp ecx, 0xffffffff
jne 0x41259e
cmp edx, ecx
je 0x4125bd
sub ecx, dword [eax + 0x5d118]
sbb edx, dword [eax + 0x5d11c]
ja 0x4125b0
cmp ecx, edi
jbe 0x4125b6
and dword [ebp - 8], 0
jmp 0x4125bb
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebx], edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0x20]
push 1
pop edi
mov dword [esi + 0x28], 9
cmp dword [eax + 4], edi
je 0x4125f9
push esi
lea eax, [esi + 0x8044]
push edi
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
je 0x41260d
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x41261a
push ebx
push dword [ebx]
push dword [esi + 0x8058]
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x4125ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x41261e
mov eax, edi
jmp 0x41262b
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.0041296e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x412cc8
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x103c
call fcn.00415c50
push ebx
mov ebx, ecx
xor eax, eax
push esi
cmp dword [ebx + 0x2480], eax
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 0x42d3b0
je 0x412cf5
mov dword [ebp - 4], 0x42d3a4
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov ax, word [0x42eef4]
mov esi, dword [ebp + 8]
mov word [ebp - 0x103c], ax
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x103a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x14], 0x42d39c
lea ecx, [eax + 0x1048]
add eax, 0x48
push ecx
push eax
push 0x42cc5c
lea eax, [ebp - 0x103c]
push 0x7ff
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
cmp dword [ebx + 0x62ab4], 0
mov eax, 0x8400c300
je 0x412d5e
mov eax, 0x8408c300
mov ecx, dword [esi + 0x20]
cmp dword [ecx + 4], 4
jne 0x412d6c
or eax, 0x803000
push esi
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x103c]
push 0x42d388
push eax
push dword [ebp - 4]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
test eax, eax
mov dword [esi + 0x1c], eax
je 0x412e38
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
lea ecx, [ebp + 8]
push 4
push ecx
push 2
push eax
mov dword [ebp + 8], 0x3a98
call edi
lea eax, [ebp - 4]
push 4
push eax
push 0x41
push dword [esi + 0x1c]
mov dword [ebp - 4], 1
call edi
push 0x28
mov dword [ebp - 8], eax
pop edi
lea eax, [ebp - 0x3c]
push edi
push 0
push eax
call sub.MSVCRT.dll_memset
mov dword [ebp - 0x3c], edi
mov edi, 0xa2d0
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x412e18
push edi
push 0
push ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0xc]
push dword [ebp - 8]
push 0xa2cf
push ebx
push esi
call fcn.00412f0f
push ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov dword [ebp - 0x30], eax
push esi
push 1
lea eax, [ebp - 0x3c]
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
test ebx, ebx
mov dword [ebp - 8], eax
je 0x412e38
push ebx
call fcn.0040ebda
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4134bd
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 8], edi
jne 0x413628
lea ebx, [esi + 0x5d128]
mov dword [ebp - 0x18], edi
push ebx
mov dword [ebp - 0x14], edi
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
add eax, 0x41
push edi
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0x10]
mov word [ebp - 0xe], 0x3a
push eax
mov word [ebp - 0xc], 0x5c
mov word [ebp - 0xa], di
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x413643
mov ecx, dword [esi + 0x5d108]
mov eax, dword [esi + 0x5d10c]
cmp ecx, 0xffffffff
jne 0x41352a
cmp eax, ecx
je 0x413549
mov edx, dword [ebp - 0x14]
cmp edx, eax
ja 0x413549
jb 0x41353a
mov eax, dword [ebp - 0x18]
cmp eax, ecx
ja 0x413549
mov dword [esi + 0x2470], 2
jmp 0x413643
push edi
push 0x20
push 4
push edi
push 1
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
je 0x41362d
cmp dword [esi + 0x26fc], edi
je 0x413628
push dword [esi + 0x26f4]
lea ebx, [esi + 0x26ec]
mov ecx, ebx
push dword [ebx + 4]
call fcn.0041482e
mov ecx, esi
call fcn.004138b9
test eax, eax
jne 0x413628
cmp dword [esi + 0x2468], edi
lea eax, [esi + 0x2468]
ja 0x4135ae
mov dword [eax], 5
push 0xa
pop ecx
cmp dword [eax], ecx
jbe 0x4135b7
mov dword [eax], ecx
mov eax, dword [esi + 0x5d108]
mov ecx, dword [esi + 0x5d10c]
sub eax, 1
mov dword [esi + 0x5cfc8], edi
mov dword [esi + 0x5cfd0], eax
lea eax, [esi + 0x5cfc0]
sbb ecx, edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
mov dword [esi + 0x5cfd4], ecx
push eax
mov ecx, ebx
mov dword [esi + 0x5cfcc], edi
call fcn.00414775
mov eax, dword [esi + 0x5d108]
mov edx, dword [esi + 0x5d10c]
push 0x20
pop ecx
call fcn.00415fe0
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push edi
push eax
push dword [esi + 0x5d108]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 1
pop eax
jmp 0x413645
mov dword [esi + 0x2470], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x2474], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov ax, word [0x42eef4]
push ebx
push esi
mov esi, ecx
push edi
mov word [ebp - 0x210], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push 0x42d564
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
shl ebx, 1
pop ecx
mov eax, ebx
push 2
push 0
neg eax
push eax
push dword [esi + 8]
call edi
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp ebx, dword [ebp - 4]
jne 0x4137dd
lea eax, [ebp - 0x210]
push 0x42d564
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
jne 0x4137dd
xor ebx, ebx
push 1
push ebx
push 0xfffffffffffffffc
pop eax
sub eax, dword [ebp - 4]
push eax
push dword [esi + 8]
call edi
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 8]
push 4
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add eax, ecx
push 1
neg eax
push ebx
push eax
push dword [esi + 8]
call edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4137e2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov eax, dword [esi + 0x26f0]
cmp eax, ebx
jne 0x413800
mov dword [ebp - 4], ebx
jmp 0x41380e
mov ecx, dword [esi + 0x26f4]
sub ecx, eax
sar ecx, 2
mov dword [ebp - 4], ecx
push 2
push ebx
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 4], ebx
je 0x4138ac
push edi
lea eax, [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push eax
lea eax, [ebp - 4]
push 4
push eax
push dword [esi + 8]
call edi
mov dword [ebp - 0xc], 4
mov eax, dword [esi + 0x26f0]
test eax, eax
je 0x413878
mov ecx, dword [esi + 0x26f4]
sub ecx, eax
sar ecx, 2
cmp ebx, ecx
jae 0x413878
lea eax, [ebp - 8]
push 0
push eax
mov eax, dword [esi + 0x26f0]
push 0x20
push dword [eax + ebx*4]
push dword [esi + 8]
call edi
add dword [ebp - 0xc], 0x20
inc ebx
jmp 0x413842
mov eax, dword [ebp - 0xc]
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push 4
push eax
push dword [esi + 8]
call edi
mov ebx, 0x42d564
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea ecx, [ebp - 8]
push 0
shl eax, 1
push ecx
push eax
push ebx
push dword [esi + 8]
call edi
pop edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
pop ebx
leave
ret
Function at 0x4138b9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov ax, word [0x42eef4]
push ebx
push esi
mov ebx, ecx
push edi
mov word [ebp - 0x224], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x222]
xor esi, esi
rep stosd dword es:[edi], eax
push 0x42d564
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
stosw word es:[edi], ax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov edi, eax
pop ecx
shl edi, 1
mov eax, edi
push 2
neg eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push eax
mov dword [ebp - 8], edi
push dword [ebx + 8]
call esi
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x224]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
push dword [ebx + 8]
call edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x413a46
lea eax, [ebp - 0x224]
push 0x42d564
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
jne 0x413a46
push 1
push eax
push 0xfffffffffffffffc
pop eax
sub eax, dword [ebp - 4]
push eax
push dword [ebx + 8]
call esi
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push dword [ebx + 8]
call edi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
add ecx, eax
push 1
neg ecx
push 0
push ecx
push dword [ebx + 8]
call esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0xc]
push 4
push eax
push dword [ebx + 8]
call edi
cmp dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jbe 0x413a14
lea esi, [ebx + 0x5cfd8]
lea ecx, [ebp - 4]
push 0
lea eax, [esi - 0x18]
push ecx
push 0x20
push eax
push dword [ebx + 8]
call edi
xor eax, eax
mov dword [esi - 0x18], eax
mov dword [esi - 0x14], eax
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add dword [esi - 0x10], ecx
adc dword [esi - 0xc], edx
mov dword [esi], eax
mov dword [esi + 4], eax
mov ecx, dword [esi - 8]
sub ecx, dword [esi - 0x10]
mov edx, dword [esi - 4]
sbb edx, dword [esi - 0xc]
add ecx, 1
adc edx, eax
add dword [ebp - 0x14], ecx
lea eax, [esi - 0x18]
lea ecx, [ebx + 0x26ec]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
adc dword [ebp - 0x10], edx
push eax
call fcn.00414775
inc dword [ebp - 8]
add esi, 0x20
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jb 0x4139b1
mov ecx, dword [ebx + 0x5d108]
mov edx, dword [ebx + 0x5d10c]
sub ecx, dword [ebp - 0x14]
lea eax, [ebx + 0x5d120]
push 1
sbb edx, dword [ebp - 0x10]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov ecx, dword [eax]
mov eax, edx
mov dword [ebx + 0x5d118], ecx
mov dword [ebx + 0x5d11c], eax
pop eax
jmp 0x413a48
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413a4d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0x805c]
mov edi, ecx
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
jne 0x413a71
mov eax, dword [ebx]
mov dword [ebp + 8], eax
xor esi, esi
cmp dword [edi + 0x26fc], esi
je 0x413b11
mov ecx, edi
call fcn.00413710
mov esi, dword [ebx + 0x8040]
push 0
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
add ecx, dword [esi + 0x18]
adc eax, dword [esi + 0x1c]
mov edx, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push ecx
push dword [edi + 8]
sar edx, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x413ac3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413b52
lea eax, [ebp - 4]
push 0
push eax
and dword [ebp - 4], 0
push dword [ebp + 8]
lea eax, [ebx + 0x40]
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x413b52
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jne 0x413b52
add dword [esi + 0x18], eax
lea eax, [edi + 0x5d118]
adc dword [esi + 0x1c], 0
mov ecx, dword [ebp - 4]
add dword [eax], ecx
push ecx
push ebx
mov ecx, edi
adc dword [eax + 4], 0
call fcn.00413b5b
mov ecx, edi
call fcn.004137e2
jmp 0x413b4d
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebx + 0x40]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x413b52
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x413b52
add dword [edi + 0x5d118], ecx
lea eax, [edi + 0x5d118]
push ecx
push ebx
mov ecx, edi
adc dword [eax + 4], esi
call fcn.00413b5b
push 1
pop eax
jmp 0x413b54
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41639e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
movzx eax, word [ecx + 0x14]
push edi
lea esi, [eax + ecx + 0x18]
cmp ebx, dword [esi + 0xc]
lea edx, [esi + 0xc]
jae 0x4163bf
mov eax, ebx
jmp 0x4163fe
movzx edi, word [ecx + 6]
xor eax, eax
test edi, edi
jbe 0x4163fb
mov dword [ebp + 0xc], edx
lea edx, [eax + 1]
cmp edx, edi
mov dword [ebp - 4], edx
jne 0x4163db
mov edx, dword [ecx + 0x50]
jmp 0x4163e1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x28]
mov dword [ebp + 0x10], edx
mov edx, dword [ebp + 0xc]
cmp ebx, dword [edx]
jb 0x4163f0
cmp ebx, dword [ebp + 0x10]
jb 0x416403
mov eax, dword [ebp - 4]
add dword [ebp + 0xc], 0x28
cmp eax, edi
jb 0x4163cc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
lea eax, [eax + eax*4]
lea ecx, [esi + eax*8]
mov eax, dword [esi + eax*8 + 0x14]
sub eax, dword [ecx + 0xc]
add eax, ebx
jmp 0x4163fe

Function at 0x41669d
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4025d2
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
xor ebx, ebx
cmp byte [0x422b64], bl
mov dword [ebp - 8], ecx
jne 0x4027c2
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
mov byte [ebp - 0x230], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
mov byte [0x422b64], 1
push eax
push 1
push ebx
push str.SoftwareEnterSafeePassAuto_ABChina
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402654
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
push ebx
push str.Path
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
lea ecx, [eax + 0xc4]
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 8], ecx
call sub.MFC42.DLL_CString::operator_2
mov ecx, 0x423868
call fcn.00419e84
test al, al
je 0x4026b8
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x12b]
mov byte [ebp - 0x12c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x12c]
push eax
push ebx
push ebx
push 0x801c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x4026b8
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x12c]
push eax
call sub.MFC42.DLL_CString::operator_2
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov ecx, 0x409
cmp eax, ecx
je 0x4026da
cmp eax, 0x804
je 0x4026da
cmp eax, 0x404
je 0x4026da
mov eax, ecx
push eax
call fcn.00418926
pop ecx
lea eax, [ebp - 1]
push eax
push str.langescertd_ABChina
lea ecx, [ebp - 0x24]
call fcn.004020e4
lea eax, [ebp - 0x24]
push eax
call fcn.00418933
pop ecx
lea ecx, [ebp - 0x24]
call fcn.00416a21
lea eax, [ebp - 1]
lea ecx, [ebp - 0x18]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.004020e4
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
je 0x40272e
lea eax, [ebp - 0x18]
push eax
call fcn.004188e0
pop ecx
jmp 0x4027b3
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x12b]
mov byte [ebp - 0x12c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x12c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebx
jle 0x40277c
cmp byte [ebp + eax - 0x12c], 0x5c
je 0x402775
dec eax
jmp 0x402764
mov byte [ebp + eax - 0x12c], bl
lea eax, [ebp - 0x12c]
push str.lang
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 1]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.004020e4
lea eax, [ebp - 0x24]
push eax
call fcn.004188e0
pop ecx
lea ecx, [ebp - 0x24]
call fcn.00416a21
cmp dword [ebp - 0x18], ebx
pop edi
je 0x4027c2
push dword [ebp - 0x18]
call sub.MFC42.DLL_operatordelete
pop ecx
pop ebx
leave
ret
Function at 0x4029b7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push ebx
push eax
xor ebx, ebx
push 2
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAutoplayHandlers
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402a0b
lea eax, [ebp - 8]
push 4
push eax
push 4
push ebx
push str.DisableAutoplay
push dword [ebp - 4]
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4029fe
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x402a0d
xor al, al
pop ebx
leave
ret

Function at 0x402af8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 8]
xor esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains95599.cn
push SysReAllocString
mov dword [ebp - 0xc], esi
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402bea
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push str.easyabc
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x402b8c
lea eax, [ebp - 0x10]
push 4
push eax
push 4
push esi
push str.http
push dword [ebp - 4]
mov dword [ebp - 0x10], 2
call edi
lea eax, [ebp - 0x10]
push 4
push eax
push 4
push esi
push str.https
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x420298
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x402be1
lea eax, [ebp - 0x10]
push 4
push eax
push 4
push esi
push str.http
push dword [ebp - 4]
mov dword [ebp - 0x10], 2
call edi
lea eax, [ebp - 0x10]
push 4
push eax
push 4
push esi
push str.https
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_abchina.com
push SysReAllocString
call ebx
test eax, eax
jne 0x402c68
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x420298
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x402c5f
push 4
lea eax, [ebp - 0x10]
pop ebx
mov dword [ebp - 0x10], 2
push ebx
push eax
push ebx
push esi
push str.http
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push esi
push str.https
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret