joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100110d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x14
mov eax, dword [0x10071350]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.100167a0
call fcn.10015660
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add eax, 8
mov eax, dword [eax]
push eax
push 0x10
lea ecx, [esp + 0x14]
push ecx
push 0x10055520
push str.DAHONGKEY
push str.BENBEN_HEYAO
call edi
lea edx, [esp + 0xc]
push edx
lea eax, [esi + 0x84]
push 0x10054c24
push eax
call fcn.100039d0
add esp, 0xc
call fcn.10015660
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add eax, 8
mov eax, dword [eax]
push eax
push 0x32
push str.DAHONGVALUE
push str.BENBEN_HEYAO
call ebx
mov dword [esi + 0x94], eax
call fcn.10015660
mov ecx, dword [eax + 8]
add eax, 8
push ecx
push 0x10
lea edx, [esp + 0x14]
push edx
push 0x10055520
push str.XIAOHONGKEY
push str.BENBEN_HEYAO
call edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x88]
push 0x10054c24
push ecx
call fcn.100039d0
add esp, 0xc
call fcn.10015660
add eax, 8
mov eax, dword [eax]
push eax
push 0x46
push str.XIAOHONGVALUE
push str.BENBEN_HEYAO
call ebx
mov dword [esi + 0x98], eax
call fcn.10015660
mov edx, dword [eax + 8]
add eax, 8
push edx
push 0x10
lea eax, [esp + 0x14]
push eax
push 0x10055520
push str.DALANKEY
push str.BENBEN_HEYAO
call edi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esi + 0x8c]
push 0x10054c24
push edx
call fcn.100039d0
add esp, 0xc
call fcn.10015660
add eax, 8
mov eax, dword [eax]
push eax
push 0xa
push str.DALANVALUE
push str.BENBEN_HEYAO
call ebx
mov dword [esi + 0x9c], eax
call fcn.10015660
add eax, 8
mov eax, dword [eax]
push eax
push 0x10
lea ecx, [esp + 0x14]
push ecx
push 0x10055520
push str.XIAOLANKEY
push str.BENBEN_HEYAO
call edi
lea edx, [esp + 0xc]
push edx
lea eax, [esi + 0x90]
push 0x10054c24
push eax
call fcn.100039d0
add esp, 0xc
call fcn.10015660
add eax, 8
mov eax, dword [eax]
push eax
push 0x28
push str.XIAOLANVALUE
push str.BENBEN_HEYAO
call ebx
push 1
push 0x3c
mov dword [esi + 0xa0], eax
call fcn.10015660
mov ecx, eax
call fcn.10015220
push 0
mov ecx, esi
call fcn.100195b6
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10026ddc
add esp, 0x14
ret
Function at 0x10015e10
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1004621b
mov eax, dword fs:[0]
push eax
sub esp, 0x408
mov eax, dword [0x10071350]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10071350]
xor eax, esp
push eax
lea eax, [esp + 0x41c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.100167a0
call fcn.10015660
add eax, 8
mov eax, dword [eax]
push eax
push 5
push str.ZDJG
push str.BENBEN_FY
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esi + 0x78], eax
call fcn.10015660
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add eax, 8
mov eax, dword [eax]
push eax
push 0x400
lea eax, [esp + 0x20]
push eax
push 0x10054c3b
push str.ZDFYS
push str.BENBEN_FY
call ebp
lea ecx, [esp + 0x18]
push ecx
lea edi, [esi + 0x80]
push 0x10054c24
push edi
call fcn.100039d0
add esp, 0xc
push 0x1005d0b0
push 0x1005d9e8
mov ecx, edi
call fcn.10011ea0
call fcn.10015660
add eax, 8
mov eax, dword [eax]
push eax
push 0x400
lea edx, [esp + 0x20]
push edx
push 0x1005d9d4
push str.ZDFY
push str.BENBEN_FY
call ebp
lea eax, [esp + 0x18]
push eax
lea ebx, [esi + 0x7c]
push 0x10054c24
push ebx
call fcn.100039d0
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
add esp, 0xc
test eax, eax
jne 0x10015fc8
mov ebx, dword [ebx]
mov eax, dword [ebx - 0xc]
push eax
push ebx
mov ecx, edi
call fcn.100036c0
push 2
push 0x1005d0b0
mov ecx, edi
call fcn.100036c0
push 0
mov ecx, esi
call fcn.100195b6
mov edi, dword [edi]
sub edi, 0x10
push edi
call fcn.100028b0
add eax, 0x10
add esp, 4
mov dword [esp + 0x14], eax
push 0x1005d9e8
push 0x1005d0b0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x42c], 0
call fcn.10011ea0
call fcn.10015660
mov edi, dword [esp + 0x14]
mov ebx, dword [eax + 8]
add eax, 8
cmp dword [edi - 4], 1
jle 0x10015f8f
mov edx, dword [edi - 0xc]
push edx
lea ecx, [esp + 0x18]
call fcn.10002940
mov edi, dword [esp + 0x14]
push ebx
push edi
push str.ZDFYS
push str.BENBEN_FY
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [edi - 0x10]
mov dword [esp + 0x424], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10015fc8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.10015660
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add eax, 8
mov eax, dword [eax]
push eax
push 1
push 0x1005d99c
push str.BENBEN_FY
call edi
mov dword [esi + 0x8c], eax
call fcn.10015660
add eax, 8
mov eax, dword [eax]
push eax
push 1
push str.LRJG
push str.BENBEN_FY
call edi
mov dword [esi + 0x90], eax
call fcn.10015660
mov ecx, dword [eax + 8]
add eax, 8
push ecx
push 0x400
lea edx, [esp + 0x20]
push edx
push 0x1005d9b8
push str.LRFY
push str.BENBEN_FY
call ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x94]
push 0x10054c24
push ecx
call fcn.100039d0
add esp, 0xc
push 0
mov ecx, esi
call fcn.100195b6
mov eax, 1
mov ecx, dword [esp + 0x41c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.10026ddc
add esp, 0x414
ret
Function at 0x1001c9f6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x1001ca3d
call fcn.1001dd7e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1001ca3d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1001ca59
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1001c570
mov esi, eax
test edi, edi
je 0x1001ca57
test ebx, ebx
je 0x1001ca57
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10026ddc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10071350]
jne 0x10026de6
repz ret
jmp fcn.1002e0bc

Function at 0x1003b1ca
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1002da36
and dword [ebp - 4], 0
cmp dword [0x1007780c], 0
mov ebx, eax
jne 0x1003b27b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1003b32c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10061f10
push edi
call esi
test eax, eax
je 0x1003b32c
push eax
call fcn.1002d9c4
mov dword [esp], 0x10061f00
push edi
mov dword [0x1007780c], eax
call esi
push eax
call fcn.1002d9c4
mov dword [esp], 0x10061eec
push edi
mov dword [0x10077810], eax
call esi
push eax
call fcn.1002d9c4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10077814], eax
call esi
push eax
call fcn.1002d9c4
pop ecx
mov dword [0x1007781c], eax
test eax, eax
je 0x1003b27b
push 0x10061eb8
push edi
call esi
push eax
call fcn.1002d9c4
pop ecx
mov dword [0x10077818], eax
mov eax, dword [0x10077818]
cmp eax, ebx
je 0x1003b2d3
cmp dword [0x1007781c], ebx
je 0x1003b2d3
push eax
call fcn.1002da3f
push dword [0x1007781c]
mov esi, eax
call fcn.1002da3f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1003b2d3
test edi, edi
je 0x1003b2d3
call esi
test eax, eax
je 0x1003b2ca
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1003b2ca
test byte [ebp - 0xc], 1
jne 0x1003b2d3
or dword [ebp + 0x10], 0x200000
jmp 0x1003b30c
mov eax, dword [0x10077810]
cmp eax, ebx
je 0x1003b30c
push eax
call fcn.1002da3f
pop ecx
test eax, eax
je 0x1003b30c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1003b30c
mov eax, dword [0x10077814]
cmp eax, ebx
je 0x1003b30c
push eax
call fcn.1002da3f
pop ecx
test eax, eax
je 0x1003b30c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1007780c]
call fcn.1002da3f
pop ecx
test eax, eax
je 0x1003b32c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1003b32e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4027df
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push edi
mov dword [ebp - 0x168], ecx
mov byte [ebp - 0x164], 0
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x163]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x34], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x33]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x13c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x13b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x38], 0x104
mov dword [ebp - 4], 0
push str.Rav.ini
push 0x20
lea ecx, [ebp - 0x34]
push ecx
push 0x428d48
push str.Items
push str.RavSetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x14], 0
jmp 0x40287d
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x1b
jge 0x4028b4
mov eax, dword [ebp - 0x14]
movsx ecx, byte [ebp + eax - 0x34]
cmp ecx, 0x40
jle 0x4028a2
mov edx, dword [ebp - 0x14]
mov al, byte [ebp + edx - 0x34]
sub al, 0x20
mov ecx, dword [ebp - 0x14]
mov byte [ebp + ecx - 0x34], al
jmp 0x4028b2
mov edx, dword [ebp - 0x14]
mov al, byte [ebp + edx - 0x34]
add al, 0x20
mov ecx, dword [ebp - 0x14]
mov byte [ebp + ecx - 0x34], al
jmp 0x402874
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x168]
call fcn.0040316c
and eax, 0xff
cmp eax, 1
jne 0x4028d7
mov eax, 4
jmp 0x402999
push 0x27
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x168]
call fcn.00402322
test eax, eax
je 0x4028fa
xor eax, eax
jmp 0x402999
lea edx, [ebp - 0x164]
push edx
call fcn.0040a411
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x402919
xor eax, eax
jmp 0x402999
lea eax, [ebp - 8]
push eax
call fcn.0040a335
add esp, 4
cmp dword [ebp + 8], 0
je 0x40295f
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cdq
mov ecx, 0x15180
idiv ecx
add eax, 1
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jle 0x40295f
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cdq
mov ecx, 0x15180
idiv ecx
sub eax, 1
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jle 0x40297f
push 1
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x168]
call fcn.00402b61
mov eax, 4
jmp 0x402999
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
cmp edx, 0xd2f00
jg 0x402994
mov eax, 3
jmp 0x402999
mov eax, 2
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4029a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
je 0x4029c1
cmp dword [ebp + 0xc], 0
je 0x4029c1
cmp dword [ebp + 0x10], 0
je 0x4029c1
cmp dword [ebp + 0x14], 0
jne 0x4029c8
xor eax, eax
jmp 0x402a5b
mov byte [ebp - 8], 1
mov dword [ebp - 0x10], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402a0d
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402a0d
xor eax, eax
jmp 0x402a5b
mov eax, dword [ebp + 0x14]
push eax
call fcn.00409ab0
add esp, 4
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402a46
mov byte [ebp - 8], 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
and eax, 0xff
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402a61
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0
je 0x402a82
cmp dword [ebp + 0xc], 0
je 0x402a82
cmp dword [ebp + 0x10], 0
je 0x402a82
cmp dword [ebp + 0x14], 0
jne 0x402a8c
mov eax, 0xffffff9a
jmp 0x402b5b
mov eax, dword [ebp + 0x18]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00409a50
add esp, 0xc
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402ac3
mov eax, 0xffffff99
jmp 0x402b5b
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x1c]
push edx
push 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402afe
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffff99
jmp 0x402b5b
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ecx]
cmp edx, dword [ebp + 0x18]
jle 0x402b19
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffff9b
jmp 0x402b5b
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402b4f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffff99
jmp 0x402b5b
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x403777
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x108], 0x104
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push 0x4253cc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4037d4
xor eax, eax
jmp 0x4038ab
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x110]
push eax
push 0
push 0x4253e0
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403815
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4038ab
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._rav_setup.dll
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x4038a9
push 0x4253fc
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x403875
xor eax, eax
jmp 0x4038ab
mov dword [ebp - 0x11c], 0
call dword [ebp - 0x118]
cmp eax, 8
jne 0x403894
mov dword [ebp - 0x11c], 1
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x11c]
jmp 0x4038ab
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4038b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0x104
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push 0x425408
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4038e4
xor eax, eax
jmp 0x403933
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x42541c
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403913
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x403933
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._rav
mov ecx, dword [ebp + 8]
push ecx
call fcn.00409b40
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x407e07
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00409a50
add esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push str.SoftwareRisingRav
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x407e51
xor al, al
jmp 0x407eaf
mov dword [ebp - 4], 1
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0x4257c4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x407e8f
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], eax
xor al, al
jmp 0x407eaf
push str.Rav
mov edx, dword [ebp + 8]
push edx
call fcn.00409b40
add esp, 8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], eax
mov al, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x407f28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x108], 0x104
mov eax, dword [ebp - 0x218]
add eax, 4
push eax
push str.SoftwareRising_s
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
push 1
push 0
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x407f92
xor eax, eax
jmp 0x408026
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
push str.installpath
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x407fd0
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x408026
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x425800
lea ecx, [ebp - 0x104]
push ecx
call fcn.00409b40
add esp, 8
mov edx, dword [ebp - 0x218]
add edx, 4
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.00409b40
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x218]
add edx, 8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4080e7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x64
mov eax, dword [ebp - 0x40c]
add eax, 4
push eax
push str.SOFTWARERISING_s
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x304]
push edx
push 1
push 0
lea eax, [ebp - 0x404]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x408152
xor eax, eax
jmp 0x4082ec
push 0x428f90
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x408], 1
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x408]
push ecx
push 0
push str.TYPE
mov edx, dword [ebp - 0x304]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4081a6
mov eax, dword [ebp - 0x304]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4082ec
lea ecx, [ebp - 0x70]
push ecx
call fcn.0040a49c
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jne 0x4081c5
mov eax, 1
jmp 0x4082ec
push 0x190
push 0
lea edx, [ebp - 0x200]
push edx
call fcn.00409a50
add esp, 0xc
mov dword [ebp - 0x408], 3
mov dword [ebp - 0xc], 0x640
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x200]
push ecx
lea edx, [ebp - 0x408]
push edx
push 0
push str.INSTALLVER
mov eax, dword [ebp - 0x304]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40822a
mov ecx, dword [ebp - 0x304]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4082ec
mov edx, dword [ebp - 0x304]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x200]
add eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x1f8]
je 0x408252
xor eax, eax
jmp 0x4082ec
mov ecx, dword [ebp - 0x200]
xor ecx, 0xab
mov dword [ebp - 0x200], ecx
mov edx, dword [ebp - 0x1fc]
xor edx, dword [ebp - 0x200]
mov dword [ebp - 0x1fc], edx
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 4]
je 0x408285
xor eax, eax
jmp 0x4082ec
mov ecx, dword [ebp - 0x40c]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x40c]
add edx, 8
push edx
push str._s_s.ver
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x300]
push edx
mov ecx, dword [ebp - 0x40c]
call fcn.004082f0
test eax, eax
jne 0x4082cc
xor eax, eax
jmp 0x4082ec
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x4082d8
xor eax, eax
jmp 0x4082ec
mov ecx, dword [ebp - 0x40c]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x10c], edx
mov eax, 1
mov esp, ebp
pop ebp
ret