Function at 0x406820
Capabilities:
Check os version
Create thread
Set current directory

Disassembly:
sub esp, 0x22c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push edi
xor edi, edi
push 0x423658
mov dword [0x423674], edi
mov dword [0x4236b0], edi
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x285
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push str.Begine_InitCore__
call fcn.00407b30
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esp, 0x14
push 0x423658
call esi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
sbb eax, eax
inc eax
mov dword [0x41b7d8], eax
call fcn.0040f010
test eax, eax
jne 0x4068a9
call fcn.004110d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x22c
ret
mov ecx, dword [0x4236f4]
mov edx, dword [ecx]
call dword [edx + 0x18]
test eax, eax
je 0x407359
mov ecx, dword [0x4236f4]
push edi
push 1
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [0x4236f4]
mov dword [0x4236fc], eax
push 0x423710
push eax
mov edx, dword [ecx]
push 0x4001
call dword [edx + 0xc]
mov ecx, dword [0x4236f4]
push edi
push 1
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [0x4236f4]
mov dword [0x423700], eax
push 0x423714
push eax
mov edx, dword [ecx]
push 0x4001
call dword [edx + 0xc]
mov ecx, dword [0x4236f4]
push edi
push 2
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [0x4236f4]
mov dword [0x423704], eax
push 0x423718
push eax
mov edx, dword [ecx]
push 0x4001
call dword [edx + 0xc]
mov ecx, dword [0x4236f4]
push edi
push 3
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [0x4236f4]
mov dword [0x423708], eax
push 0x42371c
push eax
mov edx, dword [ecx]
push 0x4001
call dword [edx + 0xc]
mov ecx, dword [0x4236f4]
push edi
push 4
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [0x4236f4]
mov dword [0x42370c], eax
push 0x423720
push eax
mov edx, dword [ecx]
push 0x4001
call dword [edx + 0xc]
push str.RSCOMMON.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.GetDLLObject
push eax
mov dword [0x423730], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 0x10
call eax
cmp eax, edi
je 0x4069df
add eax, 0xfffffffc
cmp eax, edi
mov dword [0x42372c], eax
jne 0x4069e7
push 0x423658
call ebp
push 0x2b3
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call ebx
push eax
push str.Get_GetDLLObject__function_failed_
jmp 0x407340
mov dword [0x42372c], edi
jmp 0x4069ba
cmp dword [0x423710], edi
je 0x407320
cmp dword [0x423714], edi
je 0x407320
cmp dword [0x423718], edi
je 0x407320
cmp dword [0x42371c], edi
je 0x407320
cmp dword [0x423720], edi
je 0x407320
mov ecx, dword [0x423700]
push edi
push 0x1001
mov eax, dword [ecx]
call dword [eax + 0x14]
cmp eax, edi
mov dword [0x4236f8], eax
jne 0x406a70
push 0x423658
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x2c6
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push 0x41916c
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
jmp 0x406a76
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x423658
call ebp
push 0x2ca
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x41915c
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
call fcn.00408020
mov ecx, dword [0x41b1a8]
push 0
push 0xa
mov edx, dword [ecx]
call dword [edx]
test eax, eax
je 0x406b2e
lea ecx, [eax - 4]
test ecx, ecx
mov dword [0x423738], ecx
je 0x406ace
mov eax, dword [ecx]
push 0x55730
call dword [eax + 0xc]
push 0x423658
call ebp
push 0x2d3
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x41914c
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
mov ecx, dword [0x423710]
mov eax, dword [0x4236fc]
push eax
mov edx, dword [ecx]
call dword [edx + 0xc]
test eax, eax
jne 0x406b3a
push 0x423658
call ebp
push 0x2d6
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push str.m_pPreFileRSScanner__PreScan_Failed
jmp 0x407340
mov dword [0x423738], 0
jmp 0x406ace
mov ecx, dword [0x423714]
mov eax, dword [0x423700]
push eax
mov edx, dword [ecx]
call dword [edx + 0xc]
test eax, eax
jne 0x406b70
push 0x423658
call ebp
push 0x2df
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push str.m_pFileRSScanner__PreScan_Failed
jmp 0x407340
mov ecx, dword [0x423718]
mov eax, dword [0x423704]
push eax
mov edx, dword [ecx]
call dword [edx + 0xc]
test eax, eax
jne 0x406ba6
push 0x423658
call ebp
push 0x2e9
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push str.m_pMailRSScanner__PreScan_Failed
jmp 0x407340
mov ecx, dword [0x42371c]
mov eax, dword [0x423708]
push eax
mov edx, dword [ecx]
call dword [edx + 0xc]
test eax, eax
jne 0x406bdc
push 0x423658
call ebp
push 0x2f3
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push str.m_pWebRSScanner__PreScan_Failed
jmp 0x407340
mov ecx, dword [0x423720]
mov eax, dword [0x42370c]
push eax
mov edx, dword [ecx]
call dword [edx + 0xc]
test eax, eax
push 0x423658
jne 0x406c12
call ebp
push 0x2fc
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push str.m_pBootRSScanner__PreScan_Failed
jmp 0x407340
call ebp
push 0x303
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x41908c
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
push 0x406160
push 0
call dword [sym.imp.guidll.dll__LoadMonitor_8]
test eax, eax
jne 0x406c86
push 0x423658
call ebp
push 0x307
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push str.LoadMonitor_failed_
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
push 1
call dword [sym.imp.guidll.dll__UnloadMonitor_4]
and word [0x4236a8], 0xfffd
jmp 0x406cde
push str.RAVMOND_FILENONE_THREAD_EXIT
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp + 0x10]
mov dword [0x4236d4], eax
push ecx
push 0
push 0
push 0x405e80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [esp + 0x10]
mov dword [0x42374c], eax
push edx
push 0
push 0
push 0x405bd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
mov dword [0x423748], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x423658
call ebp
push 0x313
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push str.LoadMonitor
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
push 1
call fcn.00406120
add esp, 4
test eax, eax
je 0x406ddf
push 0x423658
call ebp
push 0x317
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push str.InitCore__
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
call fcn.0040d630
mov edi, str.RsBlackList.bin
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x34]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x41b690
call fcn.004047d0
push 0x423658
call ebp
push 0x31c
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x418ff8
call fcn.00407b30
add esp, 0x14
push 0x423658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x406e12
and word [0x4236a8], 0xfffd
push 0x423658
call ebp
push 0x325
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x418fdc
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
push str.MailMon.dll
mov dword [0x423750], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x423740], eax
je 0x406f17
push 1
call fcn.00408bf0
add esp, 4
test eax, eax
je 0x406ef0
push 0x423658
call ebp
push 0x32f
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x418fb8
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
mov ecx, dword [0x4236f4]
push 0x4236e8
push 0
push 0x3fff
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [0x4236e8]
push 0x423658
test eax, eax
je 0x406ead
call ebp
push 0x334
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x418fa0
jmp 0x406ec4
call ebp
push 0x338
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push 0x418f88
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
push 0x423658
call ebp
push 0x33a
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x418f70
jmp 0x406f3c
and word [0x4236a8], 0xfff3
push 0x423658
call ebp
push 0x341
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push 0x418f60
jmp 0x406f3c
and word [0x4236a8], 0xfff3
push 0x423658
call ebp
push 0x348
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push 0x418f38
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
push str.MemMon.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 1
mov dword [0x423724], eax
call fcn.0040c480
add esp, 4
test eax, eax
je 0x406f86
push 0x423658
call ebp
push 0x34e
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x418f14
jmp 0x406fab
and word [0x4236a8], 0xfffe
push 0x423658
call ebp
push 0x353
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push 0x418efc
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
call fcn.00413090
test eax, eax
jne 0x407032
push str.expscan.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 1
mov dword [0x423744], eax
call fcn.00408a10
add esp, 4
test eax, eax
je 0x406ffe
push 0x423658
call ebp
push 0x35b
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push str.InitCore___
jmp 0x407023
and word [0x4236a8], 0xff7f
push 0x423658
call ebp
push 0x360
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push 0x418eb0
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
push str.regmon.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.HookWeb.dll
mov dword [0x423728], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 1
mov dword [0x4236f0], eax
call fcn.0040c5d0
add esp, 4
test eax, eax
je 0x40707d
push 0x423658
call ebp
push 0x36c
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x418e78
jmp 0x4070a2
and word [0x4236a8], 0xffbf
push 0x423658
call ebp
push 0x371
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push 0x418e58
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
push 1
call fcn.0040d260
add esp, 4
test eax, eax
je 0x4070dc
push 0x423658
call ebp
push 0x376
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x418e3c
jmp 0x407101
and word [0x4236a8], 0xffef
push 0x423658
call ebp
push 0x37b
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push 0x418e20
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
call fcn.00413090
test eax, eax
je 0x407136
push 0x423658
call ebp
push 0x381
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x418e08
jmp 0x407178
push 1
call fcn.0040d050
add esp, 4
test eax, eax
push 0x423658
je 0x407161
call ebp
push 0x387
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push 0x418df4
jmp 0x407178
call ebp
push 0x38b
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call edi
push eax
call ebx
push eax
push 0x418de0
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x139]
mov byte [esp + 0x138], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x138]
push eax
call fcn.0040d630
add esp, 4
lea ecx, [esp + 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call fcn.00412050
push 0
push 0
push 0xd3
push str.RAVMON.EXE_RAVMOND.EXE
push 0x41b408
mov ecx, 0x423798
call fcn.00413640
lea edx, [esp + 0x20]
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x40722f
push 0x423658
call ebp
push 0x39e
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call ebx
push eax
push str.InitCore___tInitializeSecurityDescriptor
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x22c
ret
push 0
push 0
lea eax, [esp + 0x28]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x407280
push 0x423658
call ebp
push 0x3a3
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call ebx
push eax
push str.InitCore___tSetSecurityDescriptorDacl
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x22c
ret
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 1
call fcn.004130a0
test eax, eax
mov eax, str.59B199FB_6D89_46f5_8780_C6DAA97B0A8D_SHELLWAITEXIST
je 0x4072ab
mov eax, str.Global59B199FB_6D89_46f5_8780_C6DAA97B0A8D_SHELLWAITEXIST
push eax
push 0
lea edx, [esp + 0x1c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4236ec], eax
call fcn.004130a0
test eax, eax
mov eax, str.CB508F94_4FFA_4fa7_A4BC_CFC2A25A564A_2005
je 0x4072d3
mov eax, str.GlobalCB508F94_4FFA_4fa7_A4BC_CFC2A25A564A_2005
push eax
lea eax, [esp + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x423658
mov dword [0x42373c], eax
call ebp
push 0x3b6
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
push 1
call ebx
push eax
push str.InitCore___sucessed_
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x22c
ret
push 0x423658
call ebp
push 0x2bc
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call ebx
push eax
push 0x418c70
call fcn.00407b30
add esp, 0x14
push 0x423658
call esi
call fcn.004110d0
call fcn.00411680
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x22c
ret