joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b7d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
mov eax, dword [0x42a390]
xor eax, ebp
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0xac], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov dword [esp + 0xc], eax
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x9c
call esi
test eax, eax
jne 0x40b834
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0x94
call esi
test eax, eax
je 0x40b907
cmp dword [esp + 0x20], 2
jne 0x40b907
mov eax, dword [esp + 0x14]
cmp eax, 6
jae 0x40b907
cmp eax, 4
jbe 0x40b907
push str.GlobalDCBEBF39_05BB_4826_9BDA_B8DD752EF701
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x40b8f9
cmp eax, 0xb7
je 0x40b8f9
cmp eax, 5
je 0x40b8f9
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 4
call fcn.0040a0b0
add esp, 4
push 0
push ebx
push 0
mov ecx, 0x42a134
call fcn.0040a740
mov eax, dword [ebp + 0x14]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call fcn.0040b650
add esp, 8
mov ecx, 0x42a134
mov edi, eax
call fcn.0040b5b0
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.0041413a
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041413a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d590
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x42a390]
xor eax, esp
push ebp
push esi
lea edx, [esp + 0x10]
push edx
push 0x2001f
mov ebp, ecx
mov ecx, dword [esp + 0x130]
push 0
mov dword [esp + 0x12c], eax
mov eax, dword [ebp]
push ecx
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40d5f7
lea ecx, [esp + 8]
call fcn.0040d480
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
je 0x40d605
lea ecx, [esp + 8]
call fcn.0040d480
jmp 0x40d69e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x38]
push ecx
push 0
push eax
mov dword [esp + 0x30], 0x100
call edi
test eax, eax
jne 0x40d66c
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x10]
call fcn.0040d590
mov esi, eax
test esi, esi
jne 0x40d694
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x10]
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x38]
push edx
push esi
push eax
mov dword [esp + 0x30], 0x100
call edi
test eax, eax
je 0x40d632
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40d683
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
lea ecx, [esp + 0xc]
call fcn.0040d480
pop edi
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.0041413a
add esp, 0x11c
ret 4
Function at 0x40da70
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40da82
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40e340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x42a390]
xor eax, ebp
mov dword [esp + 0x11c], eax
push ebx
xor eax, eax
cmp edx, eax
push edi
mov ebx, ecx
je 0x40e44d
cmp esi, eax
je 0x40e44d
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push str.SOFTWARERising_s
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e42a
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push str.datapath
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e3f0
sub eax, edx
mov dword [esp + 0x14], eax
je 0x40e41f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e404
sub eax, edx
sub ebx, eax
dec ebx
push ebx
push 0x42450c
push esi
call fcn.004158a8
add esp, 0xc
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e430
sub eax, edx
pop edi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, ebp
call fcn.0041413a
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041413a
mov esp, ebp
pop ebp
ret

Function at 0x40e4e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x42a390]
xor eax, ebp
mov dword [esp + 0x114], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [esp + 0xc], eax
mov ebx, ecx
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
mov eax, 0x104
lea ecx, [esp + 0x14]
call fcn.0040e470
add esp, 4
test eax, eax
je 0x40e559
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, ebp
call fcn.0041413a
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x11c]
pop edi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.0041413a
mov esp, ebp
pop ebp
ret
Function at 0x40e570
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x42a390]
xor eax, ebp
mov dword [esp + 0x224], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [esp + 0xc], eax
mov ebx, ecx
xor eax, eax
mov byte [esp + 0x120], 0
mov ecx, 0x40
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
mov eax, 0x104
lea ecx, [esp + 0x124]
mov dword [esp + 0x14], 0xffffffff
call fcn.0040e470
add esp, 4
test eax, eax
je 0x40e685
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x18], bl
mov ecx, 0x41
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x120]
push ecx
push 0x104
lea edx, [esp + 0x20]
push edx
push 0x4245dd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esp + 0x10], eax
cmp byte [esp + 0x18], bl
je 0x40e685
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push 0x425600
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
call fcn.00415a0b
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
ja 0x40e688
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push str.0X_X
push edx
call fcn.00415a0b
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp eax, ebx
ja 0x40e688
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push 0x4255f4
push ecx
call fcn.00415a0b
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
ja 0x40e688
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x22c]
pop edi
xor ecx, ebp
pop ebx
call fcn.0041413a
mov esp, ebp
pop ebp
ret

Function at 0x40e6a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x42a390]
xor eax, ebp
mov dword [esp + 0x11c], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x14]
stosb byte es:[edi], al
push edx
mov eax, 0x104
lea ecx, [esp + 0x1c]
call fcn.0040e470
add esp, 4
test eax, eax
je 0x40e72f
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, ebp
call fcn.0041413a
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
pop edi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.0041413a
mov esp, ebp
pop ebp
ret
Function at 0x40ea50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x42a390]
push ebx
xor eax, ebp
push esi
mov esi, ecx
mov dword [esp + 0x120], eax
mov eax, dword [esi + 8]
push edi
xor edi, edi
cmp eax, edi
je 0x40ea85
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov dword [esp + 0x14], edi
mov byte [esp + 0x18], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax*4 + 4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call dword [sym.imp.USER32.dll_CharUpperA]
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [edi], 0
jne 0x40eaef
lea edx, [esp + 0x18]
mov dword [esp + 0x10], edx
jmp 0x40eaf3
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea edi, [esi + 4]
push edi
push 0
push 0
push ecx
mov ecx, esi
call fcn.0040e8b0
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
lea ecx, [eax + edx*4 + 4]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esi + 8], eax
jne 0x40eb45
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, ebp
call fcn.0041413a
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
lea edx, [esp + 0x14]
push edx
push edi
lea edx, [eax + ecx*4]
push edx
push eax
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
call fcn.0040e8b0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041413a
mov esp, ebp
pop ebp
ret

Function at 0x40ebc0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebp
push 0
push 0
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40ec7d
push ebx
push esi
push edi
push 0x100000
call fcn.00413b12
add esp, 4
push 0
push 0
push 0
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
push eax
mov ecx, 0x40000
mov edi, esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x18]
push ecx
push 0x100000
push esi
push ebp
xor ebx, ebx
call edi
test eax, eax
je 0x40ec5f
jmp 0x40ec30
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40ec5f
add ecx, esi
cmp esi, ecx
mov eax, esi
jae 0x40ec4b
mov edx, dword [eax]
add eax, 4
add ebx, edx
cmp eax, ecx
jb 0x40ec40
push 0
lea edx, [esp + 0x18]
push edx
push 0x100000
push esi
push ebp
call edi
test eax, eax
jne 0x40ec30
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00414148
add esp, 4
pop edi
xor eax, eax
pop esi
test ebx, ebx
pop ebx
sete al
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4
Function at 0x40ed70
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40edd1
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x40edb3
cmp eax, 2
jne 0x40edc3
test esi, esi
mov eax, dword [esp + 0x14]
je 0x40edcd
mov cl, byte [eax + esi - 1]
test cl, cl
je 0x40edcd
pop edi
mov eax, 0xd
pop esi
ret 0xc
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc
Function at 0x40ee10
Capabilities:
Delete file
Get file size
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x42a390]
xor eax, ebp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [esp + 0x224], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esp + 0x10], eax
xor eax, eax
test esi, esi
mov ecx, 0x41
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
je 0x40eeaa
cmp byte [esi], 0
je 0x40eeaa
push 0x5c
push esi
call fcn.004152c4
add esp, 8
test eax, eax
jne 0x40eedf
push 0x105
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x18]
push 0x5c
push edx
call fcn.004155dc
add esp, 8
test eax, eax
je 0x40ee8f
mov byte [eax + 1], 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x105
sub ecx, eax
push ecx
push esi
lea edx, [esp + eax + 0x20]
push edx
jmp 0x40eed9
push 0x105
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, 0x105
sub edx, eax
push edx
push str..log
lea eax, [esp + eax + 0x20]
push eax
call ebx
lea esi, [esp + 0x18]
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40f00c
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
shl ecx, 0xa
cmp eax, ecx
jbe 0x40efd5
cmp eax, 0xffffffff
je 0x40efd5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x105
push esi
lea edx, [esp + 0x128]
xor eax, eax
mov byte [esp + 0x128], 0
mov ecx, 0x41
lea edi, [esp + 0x129]
push edx
rep stosd dword es:[edi], eax
call ebx
lea eax, [esp + 0x120]
push 0x2e
push eax
call fcn.004155dc
add esp, 8
test eax, eax
je 0x40ef68
mov byte [eax], 0
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, 0x105
sub edx, eax
push edx
push str.2.log
lea eax, [esp + eax + 0x128]
push eax
call ebx
push 0x80
lea ecx, [esp + 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x120]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041413a
mov esp, ebp
pop ebp
ret
Function at 0x40f230
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x40f24b
push eax
mov dword [esi + 0x84], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x88], 1
lea ecx, [esi + 4]
pop esi
jmp 0x403ae0

Function at 0x40f260
Capabilities:
Resume thread

Disassembly:
mov dword [ecx + 0x44], 1
ret
push esi
mov esi, ecx
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x40f27b
push eax
mov dword [esi + 0x84], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x8c], 1
lea ecx, [esi + 4]
pop esi
jmp 0x403ae0
Function at 0x40f780
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
mov eax, dword [0x42a170]
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x40f836
mov eax, 0x42a170
xor esi, esi
mov ecx, dword [esi + 0x42a174]
mov eax, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x2001f
push ebx
push ecx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40f80f
xor eax, eax
cmp edi, ebx
je 0x40f7d1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
mov edi, dword [esp + 0x10]
jne 0x40f80f
mov esi, dword [esi + 0x42a178]
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x1c]
push ecx
push ebx
push esi
push edi
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x40f80f
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x40f809
cmp eax, 2
jne 0x40f80f
cmp dword [esp + 0x10], ebx
ja 0x40f840
inc ebp
lea esi, [ebp + ebp*2]
shl esi, 2
mov ecx, dword [esi + 0x42a170]
cmp ecx, ebx
lea eax, [esi + 0x42a170]
jne 0x40f7a1
cmp edi, ebx
je 0x40f836
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
lea edx, [ebp + ebp*2]
mov eax, dword [edx*4 + 0x42a174]
push eax
push str.Detected_the_confilct_software__s
call fcn.0040f5e0
add esp, 8
cmp edi, ebx
je 0x40f864
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x40fbf0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
mov eax, dword [0x42b1a8]
push esi
mov esi, ecx
push edi
mov ecx, 0x42b1a8
call dword [eax + 0xc]
mov ecx, dword [esi + 0x94]
push ecx
lea edx, [esp + 0xc]
add eax, 0x10
push str.__s___silence
push edx
mov dword [esp + 0x14], eax
call fcn.00405050
add esp, 0xc
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x98]
mov edi, dword [esp + 8]
mov esi, dword [esi + 0x94]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
push 0
push 0
push 1
push 0
push 0
push edi
push esi
mov dword [esp + 0x44], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40fcb0
mov eax, dword [esp + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fca5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
mov eax, 1
pop esi
add esp, 0x58
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CreateProcess__s_fail__Error___d
call fcn.0040f5e0
lea eax, [edi - 0x10]
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fcdf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
xor eax, eax
pop esi
add esp, 0x58
ret
Function at 0x40fcf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x90]
mov ebx, dword [eax - 4]
mov edx, dword [eax - 8]
push esi
lea esi, [ebp + 0x90]
sub eax, 0x10
mov ecx, 1
sub ecx, ebx
sub edx, 0x104
or ecx, edx
jge 0x40fd2a
push 0x104
mov ecx, esi
call fcn.00404010
mov eax, dword [esi]
push edi
push 0x104
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [esi]
cmp edx, ebx
jne 0x40fd46
xor edi, edi
jmp 0x40fd5d
mov eax, edx
lea edi, [eax + 1]
jmp 0x40fd50
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fd50
sub eax, edi
mov edi, eax
js 0x40fd62
cmp edi, dword [edx - 8]
jle 0x40fd6c
push 0x80070057
call fcn.004038c0
mov ecx, dword [esi]
mov dword [ecx - 0xc], edi
mov edx, dword [esi]
mov byte [edi + edx], 0
mov eax, dword [ebp + 0x98]
mov edx, dword [eax - 4]
lea esi, [ebp + 0x98]
sub eax, 0x10
mov ecx, 1
sub ecx, edx
mov edx, dword [eax + 8]
sub edx, 0x104
or ecx, edx
jge 0x40fda9
push 0x104
mov ecx, esi
call fcn.00404010
mov eax, dword [esi]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [esi]
cmp edx, ebx
jne 0x40fdc1
xor edi, edi
jmp 0x40fdd3
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fdc6
sub eax, edi
mov edi, eax
js 0x40fdd8
cmp edi, dword [edx - 8]
jle 0x40fde2
push 0x80070057
call fcn.004038c0
mov ecx, dword [esi]
mov dword [ecx - 0xc], edi
mov edx, dword [esi]
push 7
push str.RavDown
mov ecx, esi
mov byte [edi + edx], 0
call fcn.004048a0
push str.Ris.dat
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0040fb60
add esp, 0xc
push eax
lea ecx, [ebp + 0x94]
call fcn.00404e80
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fe38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp + 0x80]
push eax
lea ecx, [ebp + 4]
call fcn.00403aa0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x42562c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0040ea50
cmp dword [esp + 0x18], 2
mov ebx, dword [esp + 0x1c]
jne 0x40fe91
mov esi, dword [ebx + 4]
test esi, esi
lea ecx, [ebp + 0x9c]
jne 0x40fe7c
xor eax, eax
jmp 0x40fe8a
mov eax, esi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40fe81
sub eax, edi
push eax
push esi
call fcn.00404930
test ebx, ebx
pop edi
je 0x40fe9d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret