joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ee0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor esi, esi
push esi
push esi
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [ebp + 8]
cmp edi, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x402f17
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 0x10], eax
jbe 0x402f1c
or eax, 0xffffffff
jmp 0x402f83
push ebx
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 4]
push eax
mov ebx, 0x100000
push ebx
mov esi, 0x43e7e0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x402f70
cmp dword [ebp - 4], 0
jbe 0x402f76
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], eax
push 0
lea eax, [ebp - 4]
push eax
push ebx
push esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x402f46
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop ebx
pop edi
pop esi
leave
ret

Function at 0x402f87
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push edi
push edi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 4]
push eax
push 0x100000
push 0x43e7e0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402fd3
cmp word [0x43e7e0], 0x5a4d
jne 0x402fd3
mov ecx, dword [0x43e81c]
cmp dword [ecx + 0x43e7e0], 0x4550
je 0x402fd8
or eax, 0xffffffff
jmp 0x403003
push esi
movzx esi, word [ecx + 0x43e7e6]
xor eax, eax
cmp esi, edi
jle 0x403002
lea edx, [ecx + 0x43e8e8]
mov ecx, dword [edx + 4]
add ecx, dword [edx]
cmp ecx, eax
jbe 0x402ff7
mov eax, ecx
add edx, 0x28
inc edi
movsx ecx, di
cmp ecx, esi
jl 0x402fec
pop esi
pop edi
leave
ret

Function at 0x403124
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403154
xor eax, eax
jmp 0x4031a4
movzx eax, word [ebp + 0xc]
push edi
push dword [ebp + 0x10]
push eax
push dword [0x53e9f4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push dword [0x53e9f4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push dword [0x53e9f4]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x40341b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x34b]
mov byte [ebp - 0x34c], 0
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x403562
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
test eax, eax
jle 0x403562
push edi
call esi
mov esi, 0x209
cmp eax, esi
jbe 0x40346d
push 0x6f
pop eax
jmp 0x403565
push edi
push str._s.
lea eax, [ebp - 0x34c]
push esi
push eax
call fcn.00403367
and dword [ebp + 8], 0
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40355e
lea eax, [ebp - 0x114]
push 0x43370c
push eax
call fcn.0041dcf0
test eax, eax
pop ecx
pop ecx
je 0x403522
lea eax, [ebp - 0x114]
push 0x433708
push eax
call fcn.0041dcf0
test eax, eax
pop ecx
pop ecx
je 0x403522
lea eax, [ebp - 0x114]
push eax
push edi
push 0x433700
lea eax, [ebp - 0x34c]
push esi
push eax
call fcn.00403367
add esp, 0x14
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x34c]
jne 0x403509
push eax
call fcn.0040341b
pop ecx
jmp 0x403522
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403546
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x403546
mov dword [ebp + 8], 1
cmp dword [ebp + 8], 0
je 0x4034a6
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
jmp 0x403565
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40356a
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, 0x53e7e8
push esi
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x403591
push edi
push str.C:Temp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
call fcn.00402ec3
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor ebx, ebx
test eax, eax
jne 0x4035b2
push esi
call fcn.00402be7
pop ecx
push ebx
push esi
call ebp
test eax, eax
je 0x403611
push 0x5c
push esi
call fcn.0041c718
cmp eax, ebx
pop ecx
pop ecx
je 0x4035c7
cmp byte [eax + 1], bl
jne 0x4035c7
mov byte [eax], bl
push edi
push str.RsdSfxTmp
push esi
call fcn.0041d2ed
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4035fc
push esi
call fcn.0040341b
pop ecx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.00402be7
pop ecx
push ebx
push esi
call ebp
push esi
call fcn.00402ec3
test eax, eax
jne 0x403628
cmp dword [esp + 0x14], ebx
jne 0x403624
push 0x10
push 9
push ebx
call fcn.00403073
add esp, 0xc
xor eax, eax
jmp 0x40362b
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4037dd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4038b0
cmp dword [ebp + 0xc], ebx
je 0x4038b0
push edi
push 0x40
pop ecx
push dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x110], bl
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x43376c
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push 0x104
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 1
call fcn.00403367
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x110]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x4038a5
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x433760
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
call fcn.0041c1c0
test eax, eax
pop ecx
je 0x40389c
cmp esi, 0x7fffffff
ja 0x40389c
push 0x43375c
push esi
push dword [ebp + 0xc]
call fcn.0040338e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
call fcn.0041c1c0
pop ecx
jmp 0x4038b2
xor eax, eax
pop ebx
leave
ret
Function at 0x40395e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
or dword [ebp - 4], 0xffffffff
push ebx
push edi
push 0x40
xor eax, eax
pop ecx
xor ebx, ebx
mov byte [ebp - 0x218], bl
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0x18]
mov eax, 0x104
call fcn.004038b5
test eax, eax
pop ecx
pop ecx
je 0x403a58
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x114], bl
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0x433790
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x114], bl
mov dword [ebp - 4], eax
je 0x403a58
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push 0x43378c
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.0041dd78
mov eax, dword [ebp - 0xc]
add esp, 0xc
cmp eax, ebx
ja 0x403a5b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push 0x433784
push eax
call fcn.0041dd78
mov eax, dword [ebp - 8]
add esp, 0xc
cmp eax, ebx
ja 0x403a5b
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push 0x433780
push eax
call fcn.0041dd78
mov eax, dword [ebp - 4]
add esp, 0xc
cmp eax, ebx
ja 0x403a5b
mov eax, dword [ebp + 0x10]
pop edi
pop ebx
leave
ret
Function at 0x403b79
Capabilities:
Delete file
Get file size
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
xor ebx, ebx
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
cmp edi, ebx
mov esi, 0x105
je 0x403be1
cmp byte [edi], bl
je 0x403be1
push 0x5c
push edi
call fcn.0041d272
test eax, eax
pop ecx
pop ecx
jne 0x403c0b
push esi
lea eax, [ebp - 0x10c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call fcn.0041c718
cmp eax, ebx
pop ecx
pop ecx
je 0x403bde
mov byte [eax + 1], bl
push edi
jmp 0x403bf5
push esi
lea eax, [ebp - 0x10c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x433690
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.0040338e
lea eax, [ebp - 0x10c]
mov dword [ebp + 0xc], eax
push ebx
push 0x20
push 4
push ebx
push 3
push 0xc0000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403d13
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
shl ecx, 0xa
cmp eax, ecx
jbe 0x403ce5
cmp eax, 0xffffffff
je 0x403ce5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x41
pop ecx
xor eax, eax
push esi
push dword [ebp + 0xc]
mov byte [ebp - 0x214], bl
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x214]
push 0x2e
push eax
call fcn.0041c718
cmp eax, ebx
pop ecx
pop ecx
je 0x403c8c
mov byte [eax], bl
push 0x433794
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0040338e
push 0x80
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push ebx
push 0x20
push 4
push ebx
push 3
push 0xc0000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0041c1c0
pop ecx
push eax
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e4b
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
push 0x40
xor eax, eax
mov byte [ebp - 0x108], 0
pop ecx
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
push 0x433808
mov eax, 0x104
mov edi, 0x433800
call fcn.004038b5
test eax, eax
mov edi, dword [ebp + 8]
pop ecx
pop ecx
je 0x403eb0
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
push edi
push 0x433790
push 0x4337f8
push 0x4337f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [edi], 0
jne 0x403f45
push ebx
push dword [ebp + 0xc]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push edi
mov dword [ebp + 8], eax
call fcn.0041c718
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x403f34
mov eax, dword [ebp + 8]
push esi
sub eax, ebx
add eax, edi
push eax
lea esi, [ebx + 9]
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0041cb20
push 9
push str.logfiles
push ebx
call fcn.0041c7e0
add esp, 0x18
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov byte [esi], 0x5c
je 0x403f1f
test al, 0x10
je 0x403f1f
mov eax, dword [ebp + 8]
mov byte [eax + edi + 9], 0
jmp 0x403f33
push dword [ebp - 4]
push esi
push ebx
call fcn.0041cb20
mov eax, dword [ebp + 8]
add esp, 0xc
mov byte [eax + edi], 0
pop esi
push 0x433690
push 0x104
push edi
call fcn.0040338e
pop ebx
pop edi
leave
ret
Function at 0x404422
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x43c2e0]
cmp eax, 0xffffffff
jne 0x404443
call fcn.00402c50
cmp dword [0x43c2e0], 0
jmp 0x404445
test eax, eax
je 0x404580
push esi
push edi
push 0x40
xor eax, eax
pop ecx
mov byte [ebp - 0x208], 0
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
mov byte [ebp - 0x30c], 0
pop ecx
xor eax, eax
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x433840
push dword [ebp + 8]
stosb byte es:[edi], al
call fcn.0041d3bd
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
pop ecx
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
mov ecx, 0x103
sub ecx, eax
push ecx
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp + eax - 0x208]
push eax
call fcn.0040334c
lea eax, [ebp - 0x30c]
push str._RsInstall_
push eax
call fcn.0041c620
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.0041c630
add esp, 0x10
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x104], 0
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x404533
push esi
push str.C:Temp
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.0041c718
test eax, eax
pop ecx
pop ecx
pop edi
pop esi
je 0x404552
cmp byte [eax + 1], 0
jne 0x404552
mov byte [eax], 0
lea eax, [ebp - 0x104]
push str.Rs7zSfx.log
push eax
call fcn.0041c630
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push eax
push 1
push 0x80
call fcn.0040439d
add esp, 0x18
leave
ret

Function at 0x404582
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push 0
lea eax, [ebp - 0x100]
push 0x433780
push eax
call fcn.0041c783
lea eax, [ebp - 0x100]
push eax
push 0x53f2f0
call fcn.00403f91
add esp, 0x14
lea eax, [ebp - 0x204]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
leave
ret
Function at 0x404688
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x53e7e0]
push 0xa
cdq
pop ecx
idiv ecx
cmp edx, 9
ja case.default.0x40469c
jmp dword [edx*4 + 0x404727]
call fcn.00402d43
jmp 0x404708
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
call esi
pop esi
ret
call fcn.00404582
call fcn.00402d83
jmp dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.00402d03
call fcn.00404582
jmp 0x4046e8
call fcn.00402d43
jmp fcn.00402d83
call fcn.00404582
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp fcn.00402d43
call fcn.00402d03
call fcn.00402d03
jmp dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.00404582
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp fcn.00402d03
call fcn.00402d83
call fcn.00402d83
jmp dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.00402d03
jmp fcn.00404582

Function at 0x40474f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call fcn.004045cc
mov esi, dword [esp + 0x10]
push esi
call fcn.0040341b
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ecx
xor ebx, ebx
push esi
call edi
cmp eax, 0xffffffff
je 0x40478a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.0040341b
inc ebx
cmp ebx, 0xa
pop ecx
jl 0x40476a
call fcn.004045cc
push esi
call edi
inc eax
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret

Function at 0x4047e7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
call fcn.00404688
lea eax, [ebp - 8]
push eax
push str.SOFTWARE_risingRAV
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40482f
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push str.Is3MPackage
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x404833
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
call fcn.00404688
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x110], 0
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
push eax
push str.SOFTWARE_risingRAV
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4048cd
call fcn.004045cc
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x43388c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4048cd
call fcn.00404688
lea eax, [ebp - 0x110]
push str._rsmain.exe
push eax
call fcn.0041c630
pop ecx
pop ecx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4048cd
xor esi, esi
inc esi
jmp 0x4048d4
call fcn.004045cc
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x404d39
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x430e79
call fcn.0041d9a8
sub esp, 0x390
push ebx
push esi
push edi
push 0x40
pop ecx
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x298], bl
lea edi, [ebp - 0x297]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x53e7e8
stosb byte es:[edi], al
lea eax, [ebp - 0x298]
push str._sCompsVer.inf
push eax
call fcn.0041c783
add esp, 0xc
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x194], bl
lea edi, [ebp - 0x193]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x298]
push eax
push 0x104
lea eax, [ebp - 0x194]
push eax
push 0x433aa4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x74]
call fcn.00404c82
push 1
push ebx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10], 0x3d
call fcn.004036ee
cmp eax, 0xffffffff
je 0x404f3f
mov byte [ebp + eax - 0x194], bl
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x74]
call fcn.00404c65
mov eax, dword [ebp - 0x60]
dec eax
push eax
push 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x74]
call fcn.00404ca9
cmp dword [ebp - 0x20], 0x10
mov esi, dword [ebp - 0x34]
mov byte [ebp - 4], 1
mov edi, esi
jae 0x404e1c
lea edi, [ebp - 0x34]
mov esi, edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.00403a7e
push 0x41de75
push edi
push dword [eax]
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.00403b52
add esp, 0x14
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x39c], bl
lea edi, [ebp - 0x39b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x433a74
push SysReAllocString
mov dword [ebp - 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404f34
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push str.ForbidInstall
push dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x404f34
lea eax, [ebp - 0x39c]
push eax
lea ecx, [ebp - 0x90]
call fcn.00404c82
push ebx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x40], 0xf
call fcn.004031da
lea eax, [ebp - 0x58]
push eax
lea esi, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.00404cc7
pop ecx
push ebx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x58]
call fcn.00403a9a
test eax, eax
jl 0x404f1b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x58]
call fcn.00401ae0
push ebx
push esi
lea ecx, [ebp - 0x90]
call fcn.00401ae0
push ebx
push esi
lea ecx, [ebp - 0x38]
call fcn.00401ae0
jmp 0x404f41
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00401ae0
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.00401ae0
push ebx
lea ecx, [ebp - 0x38]
push 1
call fcn.00401ae0
xor esi, esi
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.00401ae0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret