joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x234
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [esp + 0x244]
push esi
mov esi, dword [esp + 0x240]
push edi
mov edi, dword [esp + 0x240]
xor ecx, ecx
push 0x21a
push ecx
lea edx, [esp + 0x26]
push edx
mov dword [esp + 0x1c], eax
mov word [esp + 0x28], cx
call fcn.0041a230
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0x21c
call fcn.00406fe0
add esp, 0x14
cmp eax, 0xffffffff
jne 0x40dbd2
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x234
ret
lea eax, [edi + eax*2 + 2]
mov ecx, dword [eax + 4]
add eax, 4
push ebp
mov ebp, dword [eax - 4]
sub eax, edi
add eax, 4
mov dword [esp + 0x18], ecx
cmp eax, dword [esp + 0x24c]
jbe 0x40dc19
mov edx, dword [esp + 0xc]
push edx
call fcn.0041af0b
add esp, 4
pop ebp
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x234
ret
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x4334dc
push 0x4334f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push str.BkavAutoDetectRootkit.dll
lea eax, [esp + 0x28]
push 0x104
push eax
call fcn.0041af85
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40dc76
push str.MarkFileSignature
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40dc8e
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esp + 0x10]
push edx
call fcn.0041af0b
add esp, 4
xor eax, eax
jmp 0x40dccd
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
push edx
push ebp
mov dword [esi], 0x13ba
mov dword [esi + 4], 0xc
push edi
mov dword [ecx], 0xc
call eax
add esp, 0xc
push ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.0041af0b
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x240]
pop ebx
pop ebp
pop edi
pop esi
xor ecx, esp
call fcn.0041a7bc
add esp, 0x234
ret

Function at 0x40e0c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [eax]
mov eax, dword [esp + 0x1c]
mov dword [esi], 0x13b6
mov dword [esi + 4], 0xc
push 2
mov dword [eax], 0xc
call fcn.004117d0
push 2
push 1
call fcn.00411730
mov dword [esi + 8], eax
xor eax, eax
push edi
mov dword [0x484be8], eax
mov dword [0x484bec], eax
mov dword [0x484bf0], eax
mov dword [0x484bf4], eax
call fcn.00407de0
add esp, 0x10
test eax, eax
jne 0x40e126
push ebx
call fcn.00407e00
add esp, 4
call fcn.00411490
mov eax, dword [0x474160]
pop edi
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x40e150
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x474160]
or eax, 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 1
ret
Function at 0x40e160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
push 2
mov dword [eax], 0x13b7
mov dword [eax + 4], 8
call fcn.004117d0
mov eax, dword [0x474160]
add esp, 4
cmp eax, 0xffffffff
je 0x40e19c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffe
push eax
mov eax, dword [0x474160]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 1
ret

Function at 0x40e330
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
push 0x14
push 0x40
call esi
mov edi, eax
test edi, edi
je 0x40e35d
push 0x400
push 0x40
call esi
mov esi, eax
test esi, esi
jne 0x40e365
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
push ebx
push esi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.0040e270
mov edx, dword [str..pipe_bkav_service_pipe]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x3e8
push 0x14000
push 0x14000
push 0xff
push 6
push 0x40000003
push edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, eax
call esi
push edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0xc
ret

Function at 0x40e410
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40e430
pop edi
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x28]
push ebp
push esi
push 4
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x40e485
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40e47d
mov eax, dword [esp + 0x14]
cmp eax, 4
jne 0x40e478
push esi
lea ebx, [eax - 3]
call ebp
push edi
call ebp
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 0x1c
ret
cmp eax, 1
jne 0x40e482
mov ebx, 2
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 0x1c
ret

Function at 0x40e570
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push 0
lea eax, [esp + 4]
push eax
push 0
push 1
push 0
push 0
push 0
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e5cf
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push str.fScanTools
push ecx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40e5d5
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x10
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 4], 4
jne 0x40e5cf
cmp dword [esp + 8], 4
jne 0x40e5cf
mov eax, dword [esp + 0xc]
add esp, 0x10
ret
Function at 0x40e8f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
push str.HandleScanEngineInitReq
call fcn.0040e750
mov eax, dword [esp + 0x14]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push 1
mov dword [esi], 0x1389
mov dword [esi + 4], 0xc
push 1
mov dword [eax], 0xc
call fcn.00411730
mov dword [esi + 8], eax
xor eax, eax
push edi
mov dword [0x484be8], eax
mov dword [0x484bec], eax
mov dword [0x484bf0], eax
mov dword [0x484bf4], eax
call fcn.00407de0
add esp, 0x10
test eax, eax
jne 0x40e959
push ebx
call fcn.00407e00
add esp, 4
call fcn.00411490
mov eax, dword [0x474160]
pop edi
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x40e983
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x474160]
or eax, 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.00414ae0
mov eax, 1
ret
Function at 0x40e9a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
mov ebx, dword [esp + 0x420]
push esi
mov esi, dword [esp + 0x418]
push edi
mov edi, dword [esp + 0x420]
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00406f30
add esp, 8
cmp eax, 0xffffffff
je 0x40e9ff
mov ecx, dword [esp + 0x424]
lea eax, [esi + eax + 1]
mov edx, eax
sub edx, esi
cmp edx, ecx
jbe 0x40ea19
mov eax, dword [esp + 0xc]
push eax
call fcn.0041af0b
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x40c
ret
push ebp
mov ebp, dword [eax]
sub eax, esi
add eax, 4
cmp eax, ecx
jbe 0x40ea39
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0041af0b
add esp, 4
xor eax, eax
jmp 0x40eb2c
mov dword [edi], 0x7e4
mov dword [edi + 4], 0x14c
mov dword [ebx], 0x14c
test ebp, ebp
je 0x40ea53
lea ebp, [edi + 0xc]
mov edx, dword [0x474160]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x10]
push esi
mov ebx, eax
call fcn.0040dd70
add esp, 4
cmp eax, 0xffffffff
je 0x40eac1
push 0x400
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0040de50
add esp, 0xc
test eax, eax
je 0x40eb13
test bl, 0xf0
jne 0x40eab9
mov ecx, dword [esp + 0x430]
push ecx
call fcn.00407d10
add esp, 4
test eax, eax
je 0x40eab9
mov edx, dword [0x474160]
or ebx, 0x10
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebp
lea eax, [esp + 0x18]
push eax
jmp 0x40eb15
push esi
call fcn.0040de10
add esp, 4
test eax, eax
je 0x40eaf4
test bl, 0xf0
jne 0x40eb13
mov ecx, dword [esp + 0x430]
push ecx
call fcn.00407d10
add esp, 4
test eax, eax
je 0x40eb13
mov edx, dword [0x474160]
or ebx, 0x10
push ebx
push edx
jmp 0x40eb0d
mov eax, ebx
and al, 0xf0
cmp al, 0x10
jne 0x40eb13
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov ecx, dword [0x474160]
and ebx, 0xffffffef
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push esi
mov dword [edi + 8], eax
call fcn.0041af0b
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x418]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041a7bc
add esp, 0x40c
ret
Function at 0x40eb50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x80c
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
mov ebx, dword [esp + 0x820]
push esi
mov esi, dword [esp + 0x818]
push edi
mov edi, dword [esp + 0x820]
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00406fe0
add esp, 8
cmp eax, 0xffffffff
je 0x40ebaf
mov ecx, dword [esp + 0x824]
lea eax, [esi + eax*2 + 2]
mov edx, eax
sub edx, esi
cmp edx, ecx
jbe 0x40ebc9
mov eax, dword [esp + 0xc]
push eax
call fcn.0041af0b
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x80c
ret
push ebp
mov ebp, dword [eax]
sub eax, esi
add eax, 4
cmp eax, ecx
jbe 0x40ebe9
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0041af0b
add esp, 4
xor eax, eax
jmp 0x40ecd8
mov dword [edi], 0x2ef4
mov dword [edi + 4], 0x25c
mov dword [ebx], 0x25c
test ebp, ebp
je 0x40ec03
lea ebp, [edi + 0xc]
mov edx, dword [0x474160]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [esp + 0x10]
push esi
mov ebx, eax
call fcn.0040ddc0
add esp, 4
cmp eax, 0xffffffff
je 0x40ec71
push 0x400
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0040dea0
add esp, 0xc
test eax, eax
je 0x40ecbf
test bl, 0x10
jne 0x40ec69
mov ecx, dword [esp + 0x830]
push ecx
call fcn.00407d10
add esp, 4
test eax, eax
je 0x40ec69
mov edx, dword [0x474160]
or ebx, 0x10
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebp
lea eax, [esp + 0x18]
push eax
jmp 0x40ecc1
push esi
call fcn.0040de30
add esp, 4
test eax, eax
je 0x40eca4
test bl, 0x10
jne 0x40ecbf
mov ecx, dword [esp + 0x830]
push ecx
call fcn.00407d10
add esp, 4
test eax, eax
je 0x40ecbf
mov edx, dword [0x474160]
or ebx, 0x10
push ebx
push edx
jmp 0x40ecb9
test bl, 0x10
je 0x40ecbf
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [0x474160]
and ebx, 0xffffffef
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push esi
mov dword [edi + 8], eax
call fcn.0041af0b
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x818]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041a7bc
add esp, 0x80c
ret
Function at 0x40f080
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x14
push ebp
push esi
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
push edi
mov edi, edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
push 0x1f6
push 0
call sub.NETAPI32.dll_NetShareEnum
mov ebp, eax
test ebp, ebp
je 0x40f0d4
cmp ebp, 0xea
jne 0x40f1ef
mov esi, dword [esp + 0x10]
xor edi, edi
cmp dword [esp + 0xc], edi
jbe 0x40f142
cmp dword [esi + 4], 0x80000000
je 0x40f138
mov eax, dword [esi + 0x18]
test eax, eax
je 0x40f138
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40f0f3
sub eax, edx
sar eax, 1
je 0x40f138
cmp dword [esp + 0x28], 0
jne 0x40f123
mov eax, dword [esi]
test eax, eax
je 0x40f123
mov ecx, dword [esp + 0x24]
push eax
push ecx
call fcn.0041c8c0
add esp, 8
test eax, eax
je 0x40f161
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 0x24]
push edx
push eax
call fcn.0041c8c0
add esp, 8
test eax, eax
je 0x40f161
inc edi
add esi, 0x28
cmp edi, dword [esp + 0xc]
jb 0x40f0e0
mov ecx, dword [esp + 0x10]
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
cmp ebp, 0xea
je 0x40f0a0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov edx, dword [esi]
push 0
push edx
push 0
call sub.NETAPI32.dll_NetShareDel
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call sub.NETAPI32.dll_NetApiBufferFree
test esi, esi
jne 0x40f187
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
add esp, 0x14
ret
cmp esi, 0x57
ja 0x40f1da
je 0x40f1c4
cmp esi, 5
je 0x40f1ae
cmp esi, 8
jne 0x40f1ef
push str.NetShareDel_return_ERROR_NOT_ENOUGH_MEMORY
call fcn.0040e750
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret
push str.NetShareDel_return_ERROR_ACCESS_DENIED
call fcn.0040e750
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret
push str.NetShareDel_return_ERROR_INVALID_PARAMETER
call fcn.0040e750
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret
cmp esi, 0x906
jne 0x40f1ef
push str.NetShareDel_return_NERR_NetNameNotFound
call fcn.0040e750
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret
Function at 0x40f400
Capabilities:
Allocate thread local storage
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4322ce
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
push esi
push edi
mov eax, dword [0x4417c0]
xor eax, esp
push eax
lea eax, [esp + 0x81c]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
push 0
push 1
push 0
mov dword [0x474160], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x424
mov dword [0x484980], eax
call fcn.0041aea6
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x824], 0
test eax, eax
je 0x40f481
mov ecx, eax
call fcn.00412d20
jmp 0x40f483
xor eax, eax
mov dword [esp + 0x824], 0xffffffff
mov dword [0x4865ec], eax
call fcn.00412f10
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x40f2f0
push 0
push 0
call esi
push 0x1764
push 0
push 0x484bf8
mov edi, eax
call fcn.0041a230
add esp, 0xc
push 0x44dfe8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40f4e2
push edi
call ebx
jmp 0x40f4fe
push 0
push str.Create_main_thread_error
call fcn.0040e600
mov ecx, dword [0x484980]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x40e3c0
push 0
push 0
call esi
push eax
call ebx
call fcn.0040e570
cmp eax, 1
je 0x40f54f
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x40e4f0
push 0
push 0
call esi
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x413ea0
push 0
push 0
call esi
push eax
call ebx
jmp 0x40f59b
push 0
push 0
call fcn.00406bc0
push eax
push str._sLiveUpdate.dll
lea edx, [esp + 0x28]
push 0x800
push edx
call fcn.0041b1d3
add esp, 0x18
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4849a4], eax
test eax, eax
je 0x40f59b
push str.LaunchLiveUpdate
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f59b
push 0
call eax
add esp, 4
mov ecx, dword [esp + 0x81c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x818
ret
Function at 0x4116c0
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411712
push 4
lea edx, [esp + 4]
push edx
push 4
push eax
mov eax, dword [esp + 0x18]
push str.fCloudScanMode
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x411716
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x4119f0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4865e4]
push ebx
mov ebx, dword [esp + 8]
and eax, ebx
cmp eax, ebx
je 0x411be5
push ebp
push esi
push edi
push 0x44dfe8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebp, ebp
cmp dword [0x484ce8], ebp
jne 0x411a28
mov dword [0x4865a0], ebp
mov dword [0x48659c], ebp
cmp dword [0x484cb4], ebp
jne 0x411a42
mov dword [0x48635c], ebp
mov dword [0x486358], ebp
mov dword [0x486354], ebp
mov edi, 2
cmp ebx, edi
jne 0x411ae7
cmp dword [0x484c48], ebp
jne 0x411a77
push ebp
push 0x484bf8
push 0x484cec
push 0x484df0
call fcn.00403900
add esp, 0x10
cmp dword [0x484c48], ebp
je 0x411a7d
or dword [0x484c98], edi
mov eax, dword [0x484c64]
cmp eax, ebp
jne 0x411aac
push 7
push 0x484bf8
push 0x484cec
push 0x48550c
call fcn.00403900
mov eax, dword [0x484c64]
add esp, 0x10
cmp eax, ebp
je 0x411bc8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadCloudDatabase
push eax
call esi
mov dword [0x48635c], eax
cmp eax, ebp
je 0x411acf
push edi
call eax
add esp, 4
or dword [0x484cb4], edi
mov ecx, dword [0x484c64]
push str.CloudDatabaseCleanUp
push ecx
call esi
mov dword [0x486358], eax
jmp 0x411bc8
xor esi, esi
cmp dword [0x486240], ebp
jbe 0x411bc8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x411b00
cmp dword [esi*4 + 0x484c48], ebp
jne 0x411b2b
mov edx, esi
imul edx, edx, 0x104
push esi
push 0x484bf8
add edx, 0x484df0
push 0x484cec
push edx
call fcn.00403900
add esp, 0x10
mov eax, dword [esi*4 + 0x484c48]
cmp eax, ebp
je 0x411bbb
cmp esi, 7
jne 0x411b70
mov eax, dword [0x484c64]
push str.LoadCloudDatabase
push eax
call edi
mov dword [0x48635c], eax
cmp eax, ebp
je 0x411b5b
push ebx
call eax
add esp, 4
mov ecx, dword [0x484c64]
push str.CloudDatabaseCleanUp
push ecx
call edi
mov dword [0x486358], eax
jmp 0x411bb4
cmp dword [0x4865a0], ebp
jne 0x411b85
push str.EnableDeepScan
push eax
call edi
mov dword [0x4865a0], eax
mov eax, dword [0x48659c]
cmp eax, ebp
jne 0x411ba2
mov edx, dword [esi*4 + 0x484c48]
push str.GetFullScanOption
push edx
call edi
mov dword [0x48659c], eax
cmp dword [0x4865a0], ebp
je 0x411bb4
cmp eax, ebp
je 0x411bb4
or dword [0x484ce8], ebx
or dword [esi*4 + 0x484c98], ebx
inc esi
cmp esi, dword [0x486240]
jb 0x411b00
or dword [0x4865e4], ebx
push 0x44dfe8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebp
call fcn.004119a0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x411dc0
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x110], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
mov eax, dword [esp + 0x118]
jb 0x411e1b
test eax, eax
jle 0x411e0a
dec eax
push eax
push str.BkavSysLib
lea eax, [esp + 8]
push str..Global_s_d
push eax
call fcn.0041b156
add esp, 0x10
jmp 0x411e51
push str.BkavSysLib
push str..Global_s
lea ecx, [esp + 8]
push ecx
jmp 0x411e49
test eax, eax
jle 0x411e3a
dec eax
push eax
push str.BkavSysLib
lea edx, [esp + 8]
push str.._s_d
push edx
call fcn.0041b156
add esp, 0x10
jmp 0x411e51
push str.BkavSysLib
push str.._s
lea eax, [esp + 8]
push eax
call fcn.0041b156
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x114
ret
Function at 0x411e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x160
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x15c], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x6d]
push ebx
push eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x74], bl
call fcn.0041a230
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov esi, 1
add esp, 0xc
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
cmp dword [0x486248], esi
jb 0x411fb2
nop
cmp dword [esp + esi*4 + 0x18], 0xffffffff
jne 0x411f44
push esi
call fcn.00411dc0
add esp, 4
mov dword [esp + esi*4 + 0x18], eax
mov edi, dword [esp + esi*4 + 0x18]
cmp edi, 0xffffffff
je 0x411f86
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 0
push 0x830001b4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x411f6f
lea ebx, [eax + 1]
push edi
call ebp
mov eax, dword [0x486248]
mov dword [esp + esi*4 + 0x18], 0xffffffff
inc esi
cmp esi, eax
jbe 0x411f30
jmp 0x411f9b
mov eax, dword [0x486248]
xor edx, edx
cmp eax, dword [0x486244]
sete dl
inc edx
mov dword [esp + 0x10], edx
test ebx, ebx
je 0x411fb2
xor ecx, ecx
cmp eax, dword [0x486244]
sete cl
lea ecx, [ecx + ecx + 1]
mov dword [esp + 0x10], ecx
xor esi, esi
or edi, 0xffffffff
mov eax, dword [esp + esi*4 + 0x18]
cmp eax, edi
je 0x411fc6
push eax
call ebp
mov dword [esp + esi*4 + 0x18], edi
inc esi
cmp esi, 0x14
jb 0x411fb7
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x412065
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea edx, [esp + 0x6c]
push 0
push edx
call fcn.0041a230
push str.BkavCoreLibDriver
lea eax, [esp + 0x78]
push str.._s
push eax
call fcn.0041b156
add esp, 0x18
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, edi
jne 0x412038
mov eax, 2
jmp 0x412065
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
push 0
push 0x830001b4
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
test eax, eax
jne 0x412061
call ebp
mov eax, 3
jmp 0x412065
call ebp
xor eax, eax
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041a7bc
add esp, 0x160
ret