joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cd10
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x41cd71
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, eax
push ebp
call fcn.0042a3e2
mov esi, eax
add esi, 2
lea edi, [esi + esi]
push edi
call fcn.00429bd8
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41cd6a
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
cmp esi, 0x7fffffff
rep stosb byte es:[edi], al
ja 0x41cd6a
push ebp
push esi
push ebx
call fcn.00408090
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebp, eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41cd80
sub eax, edx
lea ebx, [eax + 2]
lea edi, [ebx + ebx]
push edi
call fcn.00429bd8
mov esi, eax
add esp, 4
test esi, esi
je 0x41cdc1
mov ecx, edi
mov edx, ecx
push ebx
shr ecx, 2
push esi
xor eax, eax
push 0xffffffffffffffff
mov edi, esi
rep stosd dword es:[edi], eax
push ebp
mov ecx, edx
push 1
and ecx, 3
push 0
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x41d8f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x100
push esi
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x3f
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x100
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 8]
push 0x5c
push ecx
call fcn.0042b250
add esp, 8
test eax, eax
je 0x41d9a8
lea edx, [esp + 8]
push 0x5c
push edx
mov esi, str.NetConfig.ini
mov edi, 0x100
call fcn.0042b250
add esp, 8
mov cl, byte [esi]
test cl, cl
je 0x41d960
mov byte [eax], cl
inc eax
inc esi
dec edi
jne 0x41d951
jmp 0x41d964
test edi, edi
jne 0x41d965
dec eax
mov esi, dword [ebp + 8]
mov byte [eax], 0
lea eax, [esp + 8]
push eax
push 0x100
push esi
push str.Rav.ini
push 0x43e644
push str.SETTING
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x2e
push esi
call fcn.0042b250
add esp, 8
test eax, eax
je 0x41d9a8
push 0x2e
push esi
call fcn.0042b250
add esp, 8
mov byte [eax], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e2a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
xor eax, eax
cmp edx, eax
push edi
je 0x41e381
cmp esi, eax
je 0x41e381
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push str.SOFTWARERising_s
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push 0x104
push eax
mov dword [esp + 0x20], 1
call fcn.00401a90
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e36e
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push str.datapath
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e340
sub eax, edx
mov dword [esp + 0x14], eax
je 0x41e363
cmp ebx, 0x7fffffff
ja 0x41e363
push 0x43d854
push ebx
push esi
call fcn.00401ac0
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e373
sub eax, edx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41e400
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 0x14]
or esi, 0xffffffff
test edi, edi
je 0x41e4d9
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e437
sub eax, edx
cmp eax, 2
jb 0x41e4d9
cmp byte [edi + 1], 0x3a
jne 0x41e47d
lea eax, [esp + 0x10]
mov edx, edi
mov ecx, eax
mov esi, 0x104
sub edx, ecx
mov edi, edi
mov cl, byte [edx + eax]
test cl, cl
je 0x41e473
mov byte [eax], cl
inc eax
dec esi
jne 0x41e460
dec eax
mov byte [eax], 0
jmp 0x41e4bb
test esi, esi
jne 0x41e478
dec eax
mov byte [eax], 0
jmp 0x41e4bb
mov edx, dword [ebp + 0x18]
mov ebx, 0x104
lea esi, [esp + 0x10]
call fcn.0041e2a0
mov ecx, ebx
mov eax, esi
cmp byte [eax], 0
je 0x41e49d
inc eax
dec ecx
jne 0x41e492
jmp 0x41e4bb
test ecx, ecx
je 0x41e4bb
mov eax, 0x104
sub eax, ecx
push edi
mov edx, 0x104
sub edx, eax
push edx
lea eax, [esp + eax + 0x18]
push eax
call fcn.00401710
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ef10
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov edx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov byte [esp + 0x18], 0
mov ecx, 0x3f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
test edx, edx
mov byte [esp + 0x118], 0
mov ecx, 0x3f
lea edi, [esp + 0x119]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp + 0xc], 0
lea eax, [esp + 0x18]
jne 0x41ef6c
push eax
call fcn.0041d8f0
add esp, 4
jmp 0x41ef8e
lea ecx, [esp + 0x18]
mov esi, 0x100
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x41ef86
mov byte [eax], cl
inc eax
dec esi
jne 0x41ef77
jmp 0x41ef8a
test esi, esi
jne 0x41ef8b
dec eax
mov byte [eax], 0
lea edx, [esp + 0xc]
push edx
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41efea
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41f010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
mov eax, dword [ebp + 8]
test eax, eax
push esi
push edi
mov esi, ecx
je 0x41f041
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
cmp ecx, eax
mov dword [esi + 4], eax
sbb eax, eax
neg eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov byte [esp + 8], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [esp + 0xc]
stosw word es:[edi], ax
push edx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 8]
push 0x5c
push eax
call fcn.004299c4
add esp, 8
test eax, eax
je 0x41f07f
mov byte [eax + 1], 0
push str.RSCOMMON.DLL
push 0x104
lea ecx, [esp + 0x10]
push ecx
call fcn.00401ac0
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea edx, [esp + 8]
push edx
call edi
test eax, eax
mov dword [esi + 4], eax
jne 0x41f0e9
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x43d854
push 0x104
lea ecx, [esp + 0x10]
push ecx
call fcn.00401ac0
push str.RSCOMMON.DLL
push 0x104
lea edx, [esp + 0x10]
push edx
call fcn.00401ac0
lea eax, [esp + 8]
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
test eax, eax
jne 0x41f0fa
lea ecx, [esp + 8]
push ecx
call edi
mov dword [esi + 4], eax
mov edi, dword [esi + 4]
xor edx, edx
cmp edx, edi
sbb eax, eax
pop edi
neg eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x421ee0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x114
mov edx, dword [esp + 0x118]
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x421fea
lea ecx, [esp + 8]
call fcn.00421df0
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x421fee
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x421fa4
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.00421ee0
mov edi, eax
test edi, edi
jne 0x422006
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x421f66
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x421fbd
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x124]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x421fdc
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x421ff9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x422015
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x114
ret 4
Function at 0x4224c0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x4224d2
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x423840
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43bd18
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
push str.F25D2D67_9F54_11d4_BE4D_49878767675001
xor edi, edi
push edi
push edi
call fcn.0041a7d0
add esp, 0xc
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x423892
cmp eax, 5
je 0x423892
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov dword [esp + 0x10], 0x43f410
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 1
push str.RavMore
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], edi
call fcn.0041de30
test eax, eax
je 0x4239a6
push ebx
push ebp
call fcn.0041cd10
cmp eax, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
je 0x4238f3
lea ecx, [esp + 0x10]
push ecx
push 0x7ff
push eax
call fcn.00408290
cmp eax, edi
jl 0x4238f3
mov ebp, dword [esp + 0x10]
add ebp, ebp
jmp 0x4238f5
xor ebp, ebp
lea ebx, [ebp + 0x14]
push ebx
call fcn.00429bd8
mov esi, eax
add esp, 4
cmp esi, edi
je 0x42397a
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
cmp ebp, 0x7fffffff
rep stosb byte es:[edi], al
ja 0x42392f
push str.RavCmd
push ebp
push esi
call fcn.00401710
mov eax, dword [esp + 0x14]
push eax
push ebx
push esi
call fcn.0041d9b0
add esp, 0xc
push 1
push 0x43d888
push 0x43ed78
push ebx
push esi
push 0x25b
lea ecx, [esp + 0x30]
call fcn.00422e30
test eax, eax
je 0x42396f
push str.rav.exe_RavMore__broadcase_fail
push 8
push 0x40
call fcn.00410430
add esp, 0xc
push esi
call fcn.00429695
add esp, 4
xor edi, edi
mov ecx, dword [esp + 0x20]
cmp ecx, edi
pop ebp
pop ebx
je 0x42398f
mov edx, dword [ecx]
call dword [edx + 0x1c]
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x4239bf
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x4239bb
push str.rav.exe_register_RavMorefail
push 8
push 0x40
call fcn.00410430
mov eax, dword [esp + 0x28]
add esp, 0xc
mov ecx, dword [esp + 0x18]
cmp ecx, edi
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x10], 0x43f410
je 0x4239e0
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], edi
cmp eax, edi
je 0x4239eb
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x424d00
Capabilities:
Shutdown system

Disassembly:
call fcn.00424be0
test eax, eax
je 0x424d13
call fcn.0041af50
test eax, eax
jne 0x424d13
ret
call fcn.00424c60
neg eax
sbb eax, eax
and eax, 0xfffffff8
add eax, 8
push 0
or eax, 1
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
ret
Function at 0x426ab0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
push 0x28
mov dword [esi], 0x4400fc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x426b28
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x426b28
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x14]
push 0
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
pop esi
add esp, 0x1c
ret
Function at 0x426c50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x426c88
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
mov eax, dword [esi]
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x28], ebx
push edi
mov dword [esp + 0x10], ebx
jne 0x426caa
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x426cf5
push eax
call fcn.0042a3e2
lea ebp, [eax + eax + 2]
push ebp
call fcn.00429bd8
add esp, 8
mov ebx, eax
push 0
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
push 0
mov edi, ebx
rep stosd dword es:[edi], eax
push ebp
mov ecx, edx
push ebx
and ecx, 3
push 0xffffffffffffffff
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x38]
push eax
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push esi
push ebp
push edi
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test ebx, ebx
mov dword [esp + 0x18], eax
je 0x426d22
push ebx
call fcn.00429695
add esp, 4
cmp dword [edi], 1
jne 0x426da4
mov eax, dword [esi]
test eax, eax
je 0x426da4
lea eax, [eax + eax + 4]
push eax
call fcn.00429bd8
mov ecx, dword [esi]
lea ecx, [ecx + ecx + 4]
mov ebx, eax
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi]
add eax, 2
push eax
push ebx
push 0xffffffffffffffff
push ebp
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
call fcn.0042a3e2
mov ecx, dword [esp + 0x18]
lea eax, [eax + eax + 2]
add esp, 4
cmp eax, ecx
mov dword [esi], eax
jbe 0x426d81
mov eax, ecx
mov ecx, eax
mov edx, ecx
shr ecx, 2
mov dword [esi], eax
mov esi, ebx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
je 0x426da4
push ebx
call fcn.00429695
add esp, 4
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x426e90
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
push edi
mov dword [esp + 8], 0
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x426ea4
push 0
lea edx, [esp + 0xc]
push edx
sub eax, edi
push eax
mov eax, dword [ecx + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ecx
ret 4
Function at 0x426ed0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ecx
push 0x448698
call dword [sym.imp.USER32.dll_wvsprintfA]
mov eax, 0x448698
mov dword [esp], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x426ef5
sub eax, edx
push 0
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
push 0x448698
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
ret
Function at 0x427cc0
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
sub esp, 0x818
push ebx
mov ebx, dword [esp + 0x820]
push esi
mov esi, dword [esp + 0x828]
push edi
push esi
push ebx
mov edi, ecx
call fcn.00427310
lea eax, [esp + 0x10]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor esi, esi
cmp eax, esi
je 0x427d42
cmp eax, 2
jne 0x427d34
mov eax, str.Current_operation_system_is_no_this_registory_path_r_n
mov dword [esp + 0x20], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427d04
push esi
lea ecx, [esp + 0x24]
push ecx
sub eax, edx
mov edx, dword [edi + 0xc]
push eax
push str.Current_operation_system_is_no_this_registory_path_r_n
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x818
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x818
ret 8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ebp
push esi
push esi
mov eax, 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push esi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x3c]
push edx
push esi
mov ebp, 0x400
push eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x3c], ebp
call ebx
cmp eax, 0x103
je 0x427e23
test eax, eax
jne 0x427e47
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x42c]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
push 0
lea ecx, [esp + 0x38]
push ecx
push edx
inc esi
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x427e41
mov al, byte [esp + 0x28]
test al, al
mov dword [esp + 0x1c], ebp
jne 0x427de0
push ebp
lea eax, [esp + 0x2c]
push str.Default
push eax
call fcn.0042bad0
add esp, 0xc
lea ecx, [esp + 0x428]
push ecx
lea edx, [esp + 0x2c]
push edx
push str._s_t_t_t_s_r_n
push edi
call fcn.00426ed0
add esp, 0x10
push 0
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x3c]
push edx
push esi
push eax
call ebx
cmp eax, 0x103
jne 0x427d88
push 0x43e8a8
mov ecx, edi
call fcn.00426e90
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x818
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x818
ret 8

Function at 0x427e7b
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x43bfcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00426ab0
mov ecx, dword [esi + 0xc]
xor eax, eax
push eax
mov dword [esp + 0x120], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0x1e
push str.System_Process_Information_:_r_n
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push 0x427390
lea ecx, [esp + 0x10]
call fcn.00427b20
push 0x43f144
push esi
call fcn.00426ed0
mov ecx, dword [esp + 0x11c]
add esp, 8
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x4282f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
xor eax, eax
cmp edx, eax
push edi
je 0x4283d1
cmp esi, eax
je 0x4283d1
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push str.SOFTWARERising_s
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push 0x104
push eax
mov dword [esp + 0x20], 1
call fcn.00401a90
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4283be
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push str.datapath
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428390
sub eax, edx
mov dword [esp + 0x14], eax
je 0x4283b3
cmp ebx, 0x7fffffff
ja 0x4283b3
push 0x43d854
push ebx
push esi
call fcn.00401ac0
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4283c3
sub eax, edx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x42b5ec
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x42b609
call fcn.00433fc7
mov dword [eax], 0x16
xor eax, eax
jmp 0x42b673
push esi
push 0x8c
push 1
call fcn.0043404c
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x42b65e
push esi
call fcn.0042dde5
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x42b63c
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x42b557
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x42b672
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0042942a
test ebx, ebx
pop ecx
je 0x42b670
push ebx
call fcn.00433fd9
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret