joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ace0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x48
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x44], eax
push ebp
mov ebp, dword [esp + 0x50]
mov dword [esp + 4], 0
mov dword [esp + 8], 0
test esi, esi
je 0x40ae62
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x18]
push eax
call edi
test eax, eax
je 0x40ad30
mov eax, dword [esp + 8]
test eax, eax
jne 0x40ad58
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x40ada4
push 8
push 1
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
call edi
test eax, eax
je 0x40ada4
mov eax, dword [esp + 8]
test eax, eax
je 0x40ada4
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40ae56
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0xc]
push 1
push ecx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40adb7
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 8]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x48
ret
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
mov ebp, 4
push ebp
push ecx
mov dword [esp + 0x28], ebp
call edi
test eax, eax
je 0x40ae4b
cmp dword [esp + 0x10], 0x10
jne 0x40ae4b
mov ecx, dword [esp + 0xc]
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 2
push ecx
mov dword [esp + 0x28], ebp
call edi
test eax, eax
je 0x40ae4b
push 0x32
push 0
push esi
call fcn.004416b0
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
call fcn.00441730
mov eax, dword [esp + 0x24]
add esp, 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 8]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
lea eax, [ebp - 3]
pop ebp
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x48
ret
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 8]
push 0
push eax
jmp 0x40ad9e
mov ecx, dword [esp + 0x48]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0043e4c7
add esp, 0x48
ret
Function at 0x40af10
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push 0
push 0
lea esi, [ebx + 8]
push esi
call edi
test eax, eax
je 0x40af2f
cmp dword [esi], 0
jne 0x40af47
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x40af47
push 8
push 1
push 0
push 0
push esi
call edi
mov eax, dword [esi]
test eax, eax
je 0x40af81
lea edi, [ebx + 4]
push edi
push 0
push 0
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40af6a
cmp dword [edi], 0
jne 0x40af81
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
mov dword [edi], 0
pop edi
pop esi
ret

Function at 0x40af90
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.0044e2b0
push 0xfffffffffffffffe
push 0x489e00
push 0x441f50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x48e050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov ebx, edx
mov eax, dword [ebp + 0x100c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0xffffffff
xor edi, edi
mov dword [ebp - 0x24], edi
cmp eax, edi
je 0x40b0b4
cmp dword [ecx + 8], edi
je 0x40b0b4
cmp dword [ecx + 4], edi
je 0x40b0b4
call fcn.00407be0
test eax, eax
je 0x40b023
lea esi, [ebp - 0x24]
call fcn.00408b80
test eax, eax
je 0x40b023
mov edi, 1
push 0x47a688
push ebx
call fcn.0043fb0d
add esp, 8
mov ebx, eax
mov dword [ebp - 0x2c], ebx
test edi, edi
je 0x40b042
mov esi, dword [ebp - 0x24]
call fcn.00408bc0
test ebx, ebx
je 0x40b0b4
mov dword [ebp - 4], 0
lea ecx, [ecx]
push ebx
push 0x1000
push 1
lea eax, [ebp]
push eax
call fcn.0043fe17
add esp, 0x10
test eax, eax
jne 0x40b085
push ebx
call fcn.0043fe34
add esp, 4
test eax, eax
je 0x40b096
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
call fcn.0040b100
mov dword [ebp - 0x1c], eax
jmp 0x40b096
mov ecx, eax
lea edx, [ebp]
mov eax, dword [ebp - 0x20]
call fcn.0040b0e0
test eax, eax
jne 0x40b050
mov dword [ebp - 4], 0xfffffffe
call fcn.0040b0aa
mov eax, dword [ebp - 0x1c]
jmp 0x40b0b7
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.0043e4c7
add ebp, 0x1004
mov esp, ebp
pop ebp
ret 4
Function at 0x40c930
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x620
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x61c], eax
mov eax, dword [esp + 0x624]
push edi
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x40c976
pop edi
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x620
ret
push ebx
push esi
lea ecx, [esp + 0xc]
push ecx
push 0x410
lea edx, [esp + 0x18]
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40c9eb
xor esi, esi
test dword [esp + 0xc], 0xfffffffc
jbe 0x40c9eb
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
jmp 0x40c9b0
mov ecx, dword [esp + esi*4 + 0x10]
push 0x104
lea eax, [esp + 0x424]
push eax
push ecx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x40c9df
push str.BkavSafeRunEngine.dll
lea edx, [esp + 0x424]
push edx
call ebx
test eax, eax
jne 0x40ca0c
mov eax, dword [esp + 0xc]
inc esi
shr eax, 2
cmp esi, eax
jb 0x40c9b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x620
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x628]
pop esi
pop ebx
pop edi
xor ecx, esp
mov eax, 1
call fcn.0043e4c7
add esp, 0x620
ret
Function at 0x40ca30
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0x828
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x824], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 3
mov esi, ecx
push bind
push esi
call ebx
cmp eax, 0xffffffff
jne 0x40cab8
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
cmp edi, 0xbb8
ja 0x40cab3
push str.File_doesnt_exist._Waiting...
call fcn.00404c20
add esp, 4
push 0x64
add edi, 0x64
call ebp
push 0
push 0x80
push 3
push 0
push 3
push bind
push esi
call ebx
cmp eax, 0xffffffff
je 0x40ca72
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
jmp 0x40cac9
cmp eax, 0xffffffff
je 0x40cac3
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
jmp 0x40cac9
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push esi
lea eax, [esp + 0x20]
push 0x40a
push eax
xor ebp, ebp
call fcn.0043e9ba
add esp, 0x10
test eax, eax
je 0x40caee
xor eax, eax
jmp 0x40cbff
push 0x400
push str.:Zone.Identifier
lea ecx, [esp + 0x20]
push 0x40a
push ecx
call fcn.0043e4d6
add esp, 0x10
test eax, eax
jne 0x40cae7
lea edx, [esp + 0x18]
push edx
push str.szAdsFile_:__s
call fcn.00404c20
add esp, 8
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea eax, [esp + 0x30]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x40cb5a
inc ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.create_failed__last_error_:__d
call fcn.00404c20
add esp, 8
jmp 0x40cbdf
push str.create_ok
call fcn.00404c20
add esp, 4
cmp dword [esp + 0x83c], 0
push 0
jne 0x40cb81
lea ecx, [esp + 0x18]
push ecx
push 0x18
push str._ZoneTransfer__r_nZoneId3
jmp 0x40cb8d
lea edx, [esp + 0x18]
push edx
push 0x19
push str._ZoneTransfer__r_nZoneId10
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40cba9
push str.write_failed
inc ebp
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call edi
jmp 0x40cbdf
mov eax, dword [esp + 0x14]
push eax
push str.write_ok__dwWritten_:__d
call fcn.00404c20
add esp, 8
push esi
call edi
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea ecx, [esp + 0x30]
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x40cbea
inc ebp
cmp ebp, 1
jl 0x40cb20
jmp 0x40cbfa
push str.file_ads_created
call fcn.00404c20
add esp, 4
push esi
call edi
mov eax, 1
mov ecx, dword [esp + 0x834]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x828
ret
Function at 0x40d0a0
Capabilities:
Start service

Disassembly:
sub esp, 0x44c
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040d230
test eax, eax
jne 0x40d0e5
push str.bKillSrv_is_FALSE
call fcn.00404c20
add esp, 4
xor eax, eax
jmp 0x40d216
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
mov dword [esp + 0x10], ebp
test ebp, ebp
je 0x40d0de
push 0xf01ff
push str.BkavSystemService
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x40d20d
lea ecx, [esp + 0x14]
call fcn.004053e0
test eax, eax
je 0x40d206
push str.SystemBkavSystemService.exe
lea eax, [esp + 0x18]
push eax
push 0x47903c
mov ecx, eax
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x14
lea edx, [esp + 0x14]
push edx
push str.szDestinationName:__s_r_n
call fcn.00404c20
add esp, 8
push 0x104
lea eax, [esp + 0x238]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40d187
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName:__d
call fcn.00404c20
add esp, 8
jmp 0x40d206
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x238]
push edx
push str.szCurrentFileName:__s__szDestinationName_:__s
call fcn.00404c20
add esp, 0xc
call fcn.0040d5b0
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x23c]
push ecx
call fcn.0040d310
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40d1d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Copy_File_error:__d
call fcn.00404c20
add esp, 8
jmp 0x40d206
mov ebx, dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
push 0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x40d206
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call ebp
push 0
push 0
push edi
call ebx
mov esi, eax
test esi, esi
je 0x40d1f1
mov ebp, dword [esp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
mov ecx, dword [esp + 0x458]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x44c
ret
Function at 0x40d230
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x230
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebp
push edi
push 0
push 2
mov edi, 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40d274
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x230
ret
lea eax, [esp + 8]
push eax
push ebp
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40d25b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea esp, [esp]
lea ecx, [esp + 0x34]
push 0x457934
push ecx
call fcn.0043ec25
add esp, 8
test eax, eax
jne 0x40d2d9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
je 0x40d2d9
push ecx
push 0
push 0x1fffff
call esi
test eax, eax
je 0x40d2d9
push 0
push eax
call ebx
mov edi, eax
lea edx, [esp + 0x10]
push edx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40d2a0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x23c]
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
xor ecx, esp
call fcn.0043e4c7
add esp, 0x230
ret

Function at 0x40d310
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
sub esp, 0x228
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x23c]
push edi
mov edi, dword [esp + 0x23c]
xor eax, eax
push 0x21a
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004416b0
add esp, 0xc
cmp dword [esp + 0x244], 0
jne 0x40d393
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
test ebx, ebx
jne 0x40d438
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40d438
call fcn.0040d610
push 1
push esi
push edi
call fcn.0040d310
add esp, 0xc
jmp 0x40d43a
push str._backup
push esi
push 0x457c24
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.0043ed50
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
je 0x40d3cc
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40d403
push 1
lea edx, [esp + 0x14]
push edx
push esi
call ebx
test eax, eax
jne 0x40d403
call ebp
push eax
lea eax, [esp + 0x14]
push eax
push esi
push str.MoveFile__ws_____ws_fail__d
call fcn.00404c20
add esp, 0x10
push 1
push esi
push edi
call ebx
mov ebx, eax
test ebx, ebx
jne 0x40d42d
call ebp
push eax
push esi
push edi
push str.MoveFile__ws_____ws_fail__d
call fcn.00404c20
add esp, 0x10
push esi
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x228
ret
Function at 0x40d460
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
sub esp, 0x228
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
mov ebx, dword [esp + 0x230]
push ebp
push esi
mov esi, dword [esp + 0x23c]
push edi
xor eax, eax
push 0x21a
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004416b0
add esp, 0xc
cmp dword [esp + 0x244], 0
jne 0x40d4e3
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
test edi, edi
jne 0x40d58e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40d58e
call fcn.0040d610
push 1
push esi
push ebx
call fcn.0040d460
add esp, 0xc
jmp 0x40d590
push str._backup
push esi
push 0x457c24
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.0043ed50
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x40d51c
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40d551
push 1
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40d551
call ebp
push eax
lea eax, [esp + 0x14]
push eax
push esi
push str.CopyFile__ws_____ws_fail__d
call fcn.00404c20
add esp, 0x10
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
test edi, edi
jne 0x40d583
call ebp
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
push str.CopyFile__ws_____ws_fail__d
call fcn.00404c20
add esp, 0x10
push esi
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x228
ret

Function at 0x40d5b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push str.fEnableRenameUpdate
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x40d603
push str.SHGetValue_New_update_fail
call fcn.00404c20
add esp, 4
xor eax, eax
add esp, 0xc
ret
xor eax, eax
cmp dword [esp], eax
setne al
add esp, 0xc
ret
Function at 0x40d610
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov dword [esp + 8], 1
call fcn.0040d5b0
test eax, eax
jne 0x40d69f
push 4
lea eax, [esp + 0xc]
push eax
push 4
push str.fEnableRenameUpdate
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x40d65b
push str.Enable_NewUpdate_fail
call fcn.00404c20
add esp, 4
xor eax, eax
pop esi
add esp, 8
ret
push str.Enable_NewUpdate_Ok
call fcn.00404c20
mov eax, dword [0x496744]
add esp, 4
test eax, eax
jne 0x40d692
push 0x1404
call fcn.0043ef53
add esp, 4
test eax, eax
je 0x40d68b
mov esi, eax
call fcn.0041acd0
jmp 0x40d68d
xor eax, eax
mov dword [0x496744], eax
push 8
push eax
mov ecx, 0x457934
call fcn.0041b8f0
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x40d6b0
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d707
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 8]
mov edx, dword [esp]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40d70b
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x40d720
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
test edi, edi
jne 0x40d72d
xor eax, eax
add esp, 0xc
ret
push 0
lea eax, [esp + 4]
push eax
push 0
push 1
push 0
push 0
push 0
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d727
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
push str.dwCurrentBkuSize
push eax
call esi
test eax, eax
je 0x40d78b
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, 4
cmp dword [esp + 0xc], eax
jne 0x40d784
cmp dword [esp + 8], eax
jne 0x40d784
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
push edi
lea eax, [esp + 0x14]
push eax
push 0
push str.dwCurrentBkuSize
push ecx
call esi
test eax, eax
je 0x40d7cb
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x40d7e0
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 6
push 0
push 0
push 0
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d82d
mov edx, dword [esp]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push eax
push str.dwCurrentBkuSize
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40d831
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x40d890
Capabilities:
Get file size

Disassembly:
push esi
push str.Init_Rule_Mapping
call fcn.00404c20
add esp, 4
cmp dword [edi + 0x1c], 0
jne 0x40d923
push 0
push 0
push 3
push 0
push 1
push bind
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d8da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.CreateFile__s_error:__d
call fcn.00404c20
add esp, 0xc
xor eax, eax
pop esi
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push esi
mov dword [edi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi], eax
test eax, eax
jne 0x40d91c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileMapping_error:__d
call fcn.00404c20
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
Function at 0x40d970
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
lea esi, [esp + 0x14]
mov ebx, eax
mov dword [esp + 0x14], vtable.CCrc32Dynamic.0
mov dword [esp + 0x18], edi
call fcn.00403110
cmp dword [ebx], edi
jne 0x40d9b0
push edi
push edi
push bind
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebx], eax
cmp eax, edi
je 0x40daa9
mov eax, dword [ebx]
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 4], eax
cmp eax, edi
je 0x40daa9
push 0x1c
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [esp + 0x28]
push eax
push str.LoadRuleMapping_m_dwRuleMappingSize:__d
mov dword [ebx + 0x10], eax
call fcn.00404c20
add esp, 8
cmp dword [ebx + 0x18], 0x44
jb 0x40daa9
mov eax, dword [ebx + 4]
mov dword [ebx + 8], eax
mov edx, dword [eax + 0x10]
push edx
push str.LoadRuleMapping_m_lpRuleHeader__dwHeaderSize:__d
call fcn.00404c20
mov eax, dword [ebx + 8]
add esp, 8
cmp dword [eax + 0x10], 0x2c
jne 0x40daa9
cmp dword [eax + 0x18], edi
je 0x40daa9
push 6
push str.FWRULE
push eax
call fcn.004400bf
add esp, 0xc
test eax, eax
jne 0x40daa9
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x1c]
push ecx
push str.LoadRuleMapping_m_lpRuleHeader__dwVersion:__d
call fcn.00404c20
mov eax, dword [ebx + 8]
add esp, 8
cmp dword [eax + 0x1c], 2
jne 0x40daa9
lea edx, [esp + 0x10]
push edx
mov edx, dword [ebx + 0x18]
lea edi, [eax + 0x2c]
sub edx, 0x2c
lea eax, [esp + 0x18]
mov dword [ebx + 0xc], edi
call fcn.004031c0
test eax, eax
jne 0x40daa0
mov esi, dword [esp + 0x10]
push esi
push str.LoadRuleMapping_dwCrc:__d
call fcn.00404c20
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x14]
push ecx
push str.LoadRuleMapping_m_lpRuleHeader__dwCRC:__d
call fcn.00404c20
mov edx, dword [ebx + 8]
add esp, 0x10
cmp esi, dword [edx + 0x14]
jne 0x40daa7
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x1c], 1
xor edi, edi
cmp dword [ebx + 0x1c], edi
jne 0x40dae0
mov eax, dword [ebx + 4]
cmp eax, edi
je 0x40dabf
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebx + 4], edi
mov eax, dword [ebx]
cmp eax, edi
je 0x40dace
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
mov eax, dword [esp + 0x18]
mov ebx, dword [ebx + 0x1c]
push eax
call fcn.0043e4bc
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret