joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401063
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401138
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401127
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x401111
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x401127
push eax
push edi
push dword [ebp - 0x110]
call section..text
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x40113a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040606a
leave
ret 4
Function at 0x401d6b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7f94]
mov eax, 0x8014
call fcn.004153e0
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp + 0x7f90], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x7c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x74]
mov esi, edx
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
push str.SOFTWAREGodlike_DevelopersRAM_Saver_Pro
push 0x80000001
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401def
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x4000
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push edi
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401de6
lea eax, [ebp - 0x70]
push eax
call fcn.00408b53
pop ecx
mov esi, eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x7f90]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040606a
add ebp, 0x7f94
leave
ret

Function at 0x401e09
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
mov edi, edx
push eax
push esi
push 6
push esi
push esi
push esi
push str.SOFTWAREGodlike_DevelopersRAM_Saver_Pro
push 0x80000001
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x401e3d
xor eax, eax
jmp 0x401e67
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x401e5c
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402126
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
push 0xa
lea eax, [ebp - 0x18]
push eax
push ecx
call fcn.00408ca4
add esp, 0x10
lea eax, [ebp - 0x18]
mov ecx, 0x41c1e4
push 0
push eax
call fcn.004020c3
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4021fd
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xbc
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
xor eax, eax
mov dword [ebp - 0x44], 0x44
push ecx
xor esi, esi
mov word [ebp - 0x12], ax
xor edi, edi
mov dword [ebp - 0x40], esi
lea eax, [ebp + 0x10]
mov dword [ebp - 0x3c], esi
inc edi
mov dword [ebp - 0x38], esi
push str.CONTROL.EXE__s
push eax
mov dword [ebp - 0x18], edi
mov word [ebp - 0x14], di
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp]
push eax
lea eax, [ebp - 0x44]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40227e
push dword [ebp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp]
call esi
mov eax, edi
jmp 0x402280
xor eax, eax
mov ecx, dword [ebp + 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.0040606a
add ebp, 0x78
leave
ret
Function at 0x403df8
Capabilities:
Get memory capacity
Read .ini file

Disassembly:
push esi
push edi
mov esi, 0x422a40
mov edi, 0x41c6e0
push esi
push 0
push edi
push str.Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x421fcc], eax
cmp eax, 2
jne 0x403e68
push 0x421fd0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [0x421fdc], 0
ja 0x403e4c
cmp dword [0x421fd8], 0x3fef2000
jae 0x403e4c
and dword [0x421fcc], 0
push esi
push 0x41c61c
jmp 0x403e5c
push esi
mov dword [0x421fcc], 1
push 0x41c630
push edi
push 0x41c620
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
ret
Function at 0x404252
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x421fd8]
xor edx, edx
push ebx
mov ebx, 0xffa80
div ebx
push ebp
push esi
push edi
push 0x64
pop edi
xor edx, edx
xor ebp, ebp
div edi
push ebp
push ebx
push dword [0x421fe4]
mov edi, eax
xor esi, esi
push dword [0x421fe0]
inc esi
imul edi, ecx
call fcn.00415680
cmp edx, ebp
ja 0x404297
jb 0x404293
cmp eax, edi
jae 0x404297
mov esi, edi
sub esi, eax
imul eax, esi, 0xffa80
push 0x49
mov dword [0x4219c4], eax
pop eax
mov word [0x420798], ax
cmp dword [0x42079c], ebp
je 0x4042c7
lea eax, [esp + 0x10]
push eax
push ebp
push ebp
push 0x401e6c
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x404324
Capabilities:
Read .ini file

Disassembly:
push esi
push 0x422a40
xor esi, esi
push esi
push str.Nosaver
push 0x41c620
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 2
push esi
test eax, eax
jne 0x404348
push 1
jmp 0x404349
push esi
push 0x11
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop esi
ret

Function at 0x404487
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x422018
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.monram.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
mov eax, 0x41c5ac
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
push str.open
push dword [0x421af4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040606a
leave
ret
push 0x422a40
push 0
push 0x41c638
push 0x41c620
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x404381
jmp fcn.004043e5

Function at 0x4044ab
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x422018
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.moncpu.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
mov eax, 0x41c5ac
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
push str.open
push dword [0x421af4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040606a
leave
ret
push 0x422a40
push 0
push str.MonCPU
push 0x41c620
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x404404
jmp fcn.00404468
Function at 0x4044cf
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x18]
mov esi, ecx
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404545
lea eax, [ebp - 0x10]
xor edi, edi
push eax
push str.SeShutdownPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push edi
push edi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push edi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x404545
push edi
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
jmp 0x404547
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040606a
leave
ret

Function at 0x40462d
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, 0x422a40
push edi
push ebx
xor edi, edi
mov ebp, str.Options
push edi
push str.Auto
push ebp
call esi
mov dword [0x421fc4], eax
sub eax, edi
je 0x4046c9
sub eax, 1
je 0x4046a3
sub eax, 1
jne 0x4046d7
push edi
push ebx
push 0xf
push str.Interval
push ebp
call esi
imul eax, eax, 0xea60
push eax
push 2
push dword [0x421af4]
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 1
push 0x41cea8
push ebp
call esi
push ebx
push 0xf
push str.Reach
push ebp
mov dword [0x421fc8], eax
call esi
mov dword [0x421fc0], eax
jmp 0x4046d7
push edi
push 0x124f80
push 2
push dword [0x421af4]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x421fc8], 4
mov dword [0x421fc0], edi
jmp 0x4046d7
push 2
push dword [0x421af4]
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
ret
Function at 0x4046df
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x828], ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
shr edi, 2
call fcn.00406fc0
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCatW]
test edi, edi
je 0x404792
lea esi, [ebp - 0x61c]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x40478a
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40478a
push 0x41cebc
lea eax, [ebp - 0x20c]
push eax
call ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call ebx
push 0x41cec4
lea eax, [ebp - 0x20c]
push eax
call ebx
add esi, 8
sub edi, 1
jne 0x404748
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp word [ebp - 0x20c], 0
je 0x404812
mov ecx, 0x41cec8
call fcn.004020c3
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
mov ecx, 0x41ced0
call fcn.004020c3
push eax
lea eax, [ebp - 0x414]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
mov ecx, 0x41ced8
call fcn.004020c3
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
push 0x30
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x828]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040606a
leave
ret

Function at 0x404821
Capabilities:
Encode data using xor

Disassembly:
movzx eax, word [ecx]
test ax, ax
je 0x40483e
mov edx, eax
xor edx, 1
mov word [ecx], dx
lea ecx, [ecx + 2]
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x40482b
xor eax, eax
ret

Function at 0x404da9
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or esi, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
jmp 0x404dd1
movzx eax, word [edi]
dec ecx
xor eax, esi
lea edi, [edi + 2]
movzx eax, al
shr esi, 8
xor esi, dword [eax*4 + 0x41bd18]
test ecx, ecx
jg 0x404dbb
not esi
pop edi
mov eax, esi
pop esi
ret

Function at 0x405198
Capabilities:
Empty the recycle bin
Read .ini file

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, 0x41c620
push edi
mov edi, 0x422a40
push edi
push 0
push str.RecConf
push ebp
call esi
push edi
push 0
push str.RecNoUI
push ebp
mov ebx, eax
call esi
push 0x422a40
push 0
push str.RecNoSound
push ebp
mov edi, eax
call esi
neg eax
sbb ecx, ecx
and ecx, 4
neg edi
sbb edi, edi
xor eax, eax
and edi, 2
or ecx, edi
test ebx, ebx
setne al
or ecx, eax
push ecx
push 0
push dword [0x421af4]
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x405202
Capabilities:
Get disk information

Disassembly:
sub esp, 0x23c
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x38]
mov dword [esp + 0x24], 0x14
xorps xmm0, xmm0
push eax
push 0x104
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, dword [esp + 0x1c]
mov esi, eax
mov edi, dword [esp + 0x18]
shr esi, 2
test esi, esi
je 0x4052b2
mov eax, dword [esp + 0x14]
lea ebp, [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4052a0
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
add edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
adc ebx, dword [esp + 0x2c]
add ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
adc eax, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jmp 0x4052a4
mov ecx, dword [esp + 0x10]
add ebp, 8
sub esi, 1
jne 0x405266
mov ebp, dword [esp + 0x18]
jmp 0x4052ba
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [0x4207a0]
test eax, eax
je 0x4052d5
shrd edi, ebx, 0x14
cdq
shr ebx, 0x14
cmp ebx, edx
ja 0x4052e9
jb 0x4052d5
cmp edi, eax
ja 0x4052e9
mov eax, dword [0x421bfc]
test eax, eax
je 0x4052f3
cdq
cmp ebp, edx
jb 0x4052f3
ja 0x4052e9
cmp ecx, eax
jbe 0x4052f3
call fcn.00405198
xor eax, eax
inc eax
jmp 0x4052f5
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040606a
add esp, 0x23c
ret
Function at 0x40530e
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar
Read .ini file

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
mov ebp, str.BUTTON
push ebx
push ebp
mov esi, eax
push ebx
push esi
call edi
push ebx
push str.ReBarWindow32
push ebx
push esi
mov dword [esp + 0x20], eax
call edi
push str.Quick_Launch
push str.ToolbarWindow32
mov ebx, eax
push 0
push ebx
call edi
push 0
push str.MSTaskSwWClass
push 0
push ebx
mov dword [esp + 0x24], eax
call edi
push 0
push str.TrayNotifyWnd
push 0
push esi
mov dword [esp + 0x28], eax
call edi
push 0
push ebp
xor ebp, ebp
mov esi, eax
push ebp
push esi
call edi
push ebp
push str.SysPager
push ebp
push esi
call edi
push ebp
push str.TrayClockWClass
push ebp
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, eax
push 0x422a40
push 0
push str.Hide1
push 0x41c620
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x4053bd
push 5
jmp 0x4053bf
push 0
push dword [esp + 0x14]
call esi
push 0x422a40
push 0
push str.Hide2
push 0x41c620
call edi
test eax, eax
jne 0x4053e0
push 5
jmp 0x4053e2
push 0
push ebx
call esi
push 0x422a40
xor ebx, ebx
push ebx
push str.Hide3
push 0x41c620
call edi
test eax, eax
jne 0x405401
push 5
jmp 0x405402
push ebx
push dword [esp + 0x18]
call esi
push 0x422a40
push ebx
push str.Hide4
push 0x41c620
call edi
test eax, eax
jne 0x405422
push 5
jmp 0x405423
push ebx
push dword [esp + 0x1c]
call esi
push 0x422a40
push ebx
push str.Hide5
push 0x41c620
call edi
test eax, eax
jne 0x405443
push 5
jmp 0x405444
push ebx
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x40544f
Capabilities:
Create thread
Open clipboard
Read .ini file

Disassembly:
push ecx
push esi
push edi
push 0x422a40
xor edi, edi
mov esi, ecx
push edi
push str.Clipboard
push str.Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x405483
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 4
pop edx
mov ecx, str.Free
call fcn.00401d6b
imul eax, eax, 0xffa80
push 0x49
mov dword [0x4219c4], eax
pop eax
mov word [0x420798], ax
cmp dword [0x42079c], edi
je 0x4054c0
lea eax, [esp + 8]
push eax
push edi
push edi
push 0x401e6c
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ecx
ret

Function at 0x4054c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x422018
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.killproc.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
mov eax, 0x41c5ac
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
push str.open
push dword [0x421af4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040606a
leave
ret
Function at 0x405528
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x422018
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.killproc.exe_1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
mov eax, 0x41c5ac
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
push str.open
push dword [0x421af4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040606a
leave
ret
Function at 0x405b30
Capabilities:
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1810
call fcn.004153e0
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x180c], eax
push ebx
push edi
mov edi, 0x422a40
xor ebx, ebx
push edi
push ebx
push 0x41d16c
push 0x41c620
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x405c4e
push ebp
push esi
mov esi, 0x7fe
mov word [esp + 0x1c], ax
push esi
lea eax, [esp + 0x22]
push ebx
push eax
call fcn.00406fc0
xor eax, eax
push esi
mov word [esp + 0x82c], ax
lea eax, [esp + 0x82e]
push ebx
push eax
call fcn.00406fc0
xor eax, eax
push esi
mov word [esp + 0x1038], ax
lea eax, [esp + 0x103a]
push ebx
push eax
call fcn.00406fc0
add esp, 0x24
lea eax, [esp + 0x14]
mov esi, 0x400
push ebx
push ebx
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
push esi
lea eax, [esp + 0x1034]
push eax
push 0x41d174
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push dword [esp + 0x10]
lea eax, [esp + 0x20]
push 0x41d17c
push esi
push eax
call fcn.0040603c
add esp, 0x10
lea eax, [esp + 0x81c]
mov ebp, str.Trash
mov ebx, str.SYSFILES
push edi
push esi
push eax
mov esi, 0x41c5ac
push esi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x81c]
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x405c4c
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Temp
push ebx
call esi
push edi
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
call esi
pop esi
pop ebp
mov ecx, dword [esp + 0x1814]
pop edi
pop ebx
xor ecx, esp
call fcn.0040606a
add esp, 0x1810
ret
Function at 0x405c65
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x2a8
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp + 0x74], eax
xor edx, edx
mov ecx, str.rvsmr
call fcn.00401d6b
test eax, eax
je 0x405cab
push 0x422a40
push str.37474384
push str.Data
push 0x41c620
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
jmp 0x405d7b
push esi
xor eax, eax
push 0x98
push eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x26]
push eax
call fcn.00406fc0
add esp, 0xc
lea eax, [ebp - 0x28]
push 0x422a40
push 0x4d
push eax
push 0x41c5ac
push str.Temp
push str.SYSFILES
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x405d78
lea ecx, [ebp - 0x28]
call fcn.00404821
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x28]
push eax
call esi
cmp eax, 0x14
jl 0x405d78
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x22e]
push eax
call fcn.00406fc0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x28]
push eax
call esi
sub eax, 0x10
lea ecx, [ebp - 0x28]
lea esi, [eax + eax]
add ecx, esi
call fcn.00404da9
mov edi, eax
cmp esi, 0x208
jae 0x405d8a
xor eax, eax
mov word [ebp + esi - 0x230], ax
lea eax, [ebp - 0x230]
push eax
call fcn.00408b7d
pop ecx
xor ecx, ecx
cmp edi, eax
pop edi
sete cl
mov eax, ecx
jmp 0x405d7a
xor eax, eax
pop esi
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.0040606a
add ebp, 0x78
leave
ret
call fcn.0040619a
int3
Function at 0x405f3c
Capabilities:
Copy file
Create directory
Get common file path
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebp, 0x422a40
push edi
push ebp
push 0x41c630
mov edi, str.TEST
push edi
push edi
call esi
push ebp
xor ebx, ebx
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x405f8f
push ebp
push 0x41c61c
push edi
push edi
call esi
xor eax, eax
jmp 0x40601d
xor eax, eax
push 0x206
mov word [esp + 0x14], ax
lea eax, [esp + 0x16]
push ebx
push eax
call fcn.00406fc0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40601a
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x10]
push str.WinTools
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x10]
push ebx
push eax
call esi
push str.RAMSaverPro
lea eax, [esp + 0x14]
push eax
call edi
push ebx
lea eax, [esp + 0x14]
push eax
call esi
push str._ramsaverpro.ini
lea eax, [esp + 0x14]
push eax
call edi
push 1
lea ecx, [esp + 0x14]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040606a
add esp, 0x20c
ret

Function at 0x406975
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4069b4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4069b4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4069b4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4069b4
cmp dword [ecx + 0x74], 0xe
jbe 0x4069b4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408e62
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00408cd9

Function at 0x415080
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4150ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4150ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret