joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1e4205bb
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x400402f2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4b649c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [ebp + 0x10]
jle 0x4b64d9
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x4b64b6
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x4b64f5
dec esi
je 0x4b64ee
dec esi
jne 0x4b64fa
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x58e70f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421636
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x426a58]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 4]
mov dword [edi], 0x4239c0
mov dword [ebp - 0x14], esi
mov dword [esi], 0x42c1d8
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [0x42c1d8]
push 0
push 2
push esi
push 0x42c1d8
mov dword [ebp - 4], 0
call dword [eax]
mov eax, dword [esi + 4]
xor ecx, ecx
mov word [eax], cx
lea esi, [edi + 0x10]
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0x42c1d8
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov eax, dword [0x42c1d8]
push ecx
push 2
push esi
push 0x42c1d8
mov byte [ebp - 4], 2
call dword [eax]
mov eax, dword [esi + 4]
xor ecx, ecx
xor edx, edx
mov word [eax], cx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], 0x80000000
mov dword [edi + 0x38], ecx
mov dword [edi + 0x2c], 0xc
mov dword [edi + 0x30], 7
mov dword [edi + 0x34], 0xffffffff
mov dword [edi + 0x3c], ecx
lea ecx, [edi + 0x40]
mov dword [edi + 0x28], 0x4239a0
lea eax, [ecx + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], 0x102
mov dword [ecx], 0x42c1dc
mov dword [ecx + 8], 0x102
mov word [eax], dx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xa02870
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x6b5015
lea edi, [esi - 0x2b4015]
push edi
or ebp, 0xffffffff
jmp 0xa02892
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa02899
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa02888
mov eax, 1
add ebx, ebx
jne 0xa028ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa028bc
jne 0xa028db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa028db
dec eax
add ebx, ebx
jne 0xa028c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa028a0
add ebx, ebx
jne 0xa028d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa0292d
xor ecx, ecx
sub eax, 3
jb 0xa028f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa02962
sar eax, 1
mov ebp, eax
jmp 0xa028fe
add ebx, ebx
jne 0xa028fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa028cc
inc ecx
add ebx, ebx
jne 0xa0290c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa028cc
add ebx, ebx
jne 0xa02919
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa0290e
jne 0xa0292a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa0290e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa0294c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa0293e
jmp 0xa0288e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa0294c
add edi, ecx
jmp 0xa0288e
pop esi
mov edi, esi
mov ecx, 0xacd0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa0296a
cmp byte [edi], 0x23
jne 0xa0296a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa0296f
lea edi, [esi + 0x5f5000]
mov eax, dword [edi]
or eax, eax
je 0xa029de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x602000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x602028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa0299c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x602030]
or eax, eax
je 0xa029d8
mov dword [ebx], eax
add ebx, 4
jmp 0xa029b9
call dword [esi + 0x60202c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xa02a18
cmp al, 0xef
ja 0xa02a02
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xa029e4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
or eax, eax
jne 0xa029f1
mov eax, dword [edi]
add edi, 4
jmp 0xa029f1
mov ebp, dword [esi + 0x602034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa02a4c
sub esp, 0xffffff80
jmp 0x45f9f0
Function at 0x402140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5b21b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x220]
mov esi, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40217d
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x220]
push edi
lea ecx, [esi + 0xbc]
lea edi, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402190
sub edx, edi
lea eax, [ebp - 0x220]
sar edx, 1
push edx
push eax
call fcn.00402d70
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x4022b8
lea edx, [ebp - 0x220]
lea ecx, [esi + 0xc0]
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4021d0
sub edx, edi
lea eax, [ebp - 0x220]
sar edx, 1
push edx
push eax
call fcn.00402d70
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], 1
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x228], 0x104
push eax
lea eax, [ebp - 0x224]
push eax
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4022b8
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4022b8
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402250
sub ecx, edx
sar ecx, 1
cmp ecx, 2
jle 0x4022b8
cmp word [ebp - 0x21e], 0x3a
jne 0x402291
cmp word [ebp + ecx*2 - 0x222], 0x5c
jne 0x402291
lea eax, [ecx*2 - 2]
cmp eax, 0x21c
jae 0x4022ca
xor ecx, ecx
mov word [ebp + eax - 0x220], cx
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0xc4]
call fcn.00402e70
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.005322c6
mov esp, ebp
pop ebp
ret
call fcn.005328ca
int3
Function at 0x402970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040b876

Function at 0x402ec0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402ed5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402f14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402f10
lea ebx, [ebx]
cmp esi, edx
jae 0x402f14
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x402f00
cmp esi, edx
jb 0x402f19
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x403a90
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x403aa6
mov eax, 1
pop esi
pop ebp
ret 0x10
push edi
call fcn.00403ba0
push dword [ebp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call edi
mov dword [esi], eax
test eax, eax
je 0x403b8e
push 2
push 0
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esi + 4], eax
test eax, eax
je 0x403b87
push dword [ebp + 0xc]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
test eax, eax
je 0x403af6
push str.Initialize
push eax
call edi
mov dword [esi + 0x24], eax
push str.InitSkin
push dword [esi]
call edi
push str.CleanupSkin
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.ChangeSkinParams
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.ChangeSkinParamsEx
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.SkinWindow
push dword [esi]
mov dword [esi + 0x18], eax
call edi
cmp dword [esi + 0xc], 0
mov dword [esi + 0x1c], eax
je 0x403b87
cmp dword [esi + 0x10], 0
je 0x403b87
cmp dword [esi + 0x14], 0
je 0x403b87
cmp dword [esi + 0x18], 0
je 0x403b87
test eax, eax
je 0x403b87
push 0
push 0
push dword [esi + 4]
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov eax, dword [esi + 0xc]
call eax
test eax, eax
je 0x403b8e
mov eax, dword [esi + 0x24]
test eax, eax
je 0x403b75
push dword [esi]
call eax
pop edi
mov dword [esi + 8], 1
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, esi
call fcn.00403ba0
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x406b80
Capabilities:
Allocate thread local storage
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5b21b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x5bdf58]
cmp dword [esi], 0
jne 0x406bb3
push 0x3000
call fcn.00409e07
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x406c3e
push 0x3000
push 0
push dword [esi]
call fcn.00535060
add esp, 0xc
mov dword [esi + 4], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x5bdf5c], eax
test eax, eax
je 0x406c3e
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
test eax, eax
jne 0x406c12
push dword [0x5bdf5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x406c3e
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x406cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005322c6
mov esp, ebp
pop ebp
ret

Function at 0x406c50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x5bdf58]
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
mov dword [edi], 0
jne 0x406c75
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [edi], eax
test eax, eax
jne 0x406cba
push 0xffffffffffffffff
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
call fcn.004068c0
push eax
push dword [esi + 0xc]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
cmp dword [edi], eax
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x406fa0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b21b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], eax
push edi
mov edi, ecx
cmp edx, 8
jae 0x406fd2
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x10]
cmp dword [ecx + 4], edx
jne 0x406fc1
push ebx
push esi
lea edx, [ebp - 8]
call fcn.00406eb0
mov esi, dword [edi + 4]
cmp esi, 0xffffffff
jne 0x407054
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipe_bkav_service_pipe
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x407026
pop esi
mov dword [edi + 4], eax
mov eax, 1
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x407051
push esi
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov dword [edi + 4], esi
mov ebx, esi
cmp esi, 0xffffffff
je 0x407102
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [edi + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
test eax, eax
jne 0x4070a7
lea edx, [eax + 1]
mov ecx, edi
call fcn.00406e00
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4070f8
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [edi + 0x10]
push ebx
call esi
test eax, eax
jne 0x4070a7
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40713e
push 0
lea eax, [ebp - 0xc]
push eax
push 0x14000
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407168
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x407168
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
mov edx, 1
mov dword [edi + 4], 0xffffffff
mov ecx, edi
call fcn.00406e00
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407118
mov dword [0x5bdf60], 1
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0xc]
push eax
push 0x14000
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407168
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x407168
push ebx
call esi
pop esi
pop ebx
mov dword [edi + 4], 0xffffffff
mov eax, 2
mov dword [0x5bdf60], 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x5bdf60], 2
pop edi
call fcn.005322c6
mov esp, ebp
pop ebp
ret
Function at 0x407350
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5bdf60], 2
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 8], esi
je 0x407382
call fcn.00407190
neg eax
sbb eax, eax
inc eax
jne 0x407382
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.00406d80
mov esi, dword [ebp - 4]
test esi, esi
je 0x4073fd
mov eax, dword [esi + 0x10]
mov dword [ebp - 4], eax
test eax, eax
je 0x4073fd
mov edi, dword [esi + 0x14]
test edi, edi
je 0x4073fd
mov edx, dword [ebp - 8]
lea ecx, [eax + 0xc]
mov dword [eax], 0x2b06
mov dword [ebp - 0xc], 0
mov dword [eax + 8], ebx
call fcn.004067f0
mov ecx, dword [ebp - 4]
sub eax, ecx
mov edx, eax
mov dword [ecx + 4], eax
lea ecx, [ebp - 0xc]
push ecx
mov ecx, esi
call fcn.00406fa0
add esp, 4
test eax, eax
jne 0x4073e9
cmp dword [edi], 0x2eee
je 0x4073f3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407410
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x5bdf60], 2
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, edx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edi
mov esi, ecx
je 0x407442
call fcn.00407190
neg eax
sbb eax, eax
inc eax
je 0x4074fa
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.00406d80
mov eax, dword [ebp - 4]
test eax, eax
je 0x4074fa
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x4074fa
mov edi, dword [eax + 0x14]
test edi, edi
je 0x4074f7
mov dword [ebp - 0x14], 0
cmp ebx, 0x13c00
jbe 0x40748e
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
mov dword [ecx], 0x2b07
mov dword [ecx + 8], esi
add ecx, 0xc
call fcn.004067f0
mov ecx, dword [ebp + 0xc]
mov esi, eax
push ebx
push dword [ebp - 8]
mov dword [esi], 0
mov dword [esi + 4], ecx
mov dword [esi + 8], ebx
add esi, 0xc
push esi
call fcn.005370a0
mov eax, dword [ebp - 0x10]
sub ebx, eax
mov ecx, dword [ebp - 4]
add ebx, esi
mov edx, ebx
mov dword [eax + 4], ebx
lea eax, [ebp - 0x14]
push eax
call fcn.00406fa0
add esp, 0x10
test eax, eax
jne 0x407484
cmp dword [edi], 0x2eef
jne 0x407484
cmp dword [edi + 4], 0xc
jne 0x407484
mov eax, dword [edi + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0xc]
push ebx
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5b21b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x220]
mov esi, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x407cdd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x220]
push edi
lea ecx, [esi + 0xc0]
lea edi, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x407cf0
sub edx, edi
lea eax, [ebp - 0x220]
sar edx, 1
push edx
push eax
call fcn.00402d70
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x407e18
lea edx, [ebp - 0x220]
lea ecx, [esi + 0xc4]
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x407d30
sub edx, edi
lea eax, [ebp - 0x220]
sar edx, 1
push edx
push eax
call fcn.00402d70
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], 1
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x228], 0x104
push eax
lea eax, [ebp - 0x224]
push eax
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x407e18
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x407e18
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407db0
sub ecx, edx
sar ecx, 1
cmp ecx, 2
jle 0x407e18
cmp word [ebp - 0x21e], 0x3a
jne 0x407df1
cmp word [ebp + ecx*2 - 0x222], 0x5c
jne 0x407df1
lea eax, [ecx*2 - 2]
cmp eax, 0x21c
jae 0x407e2a
xor ecx, ecx
mov word [ebp + eax - 0x220], cx
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0xc8]
call fcn.00402e70
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.005322c6
mov esp, ebp
pop ebp
ret
call fcn.005328ca
int3
Function at 0x409370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5b21b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x220]
mov esi, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4093ad
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x220]
push edi
lea ecx, [esi + 0x9c]
lea edi, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4093c0
sub edx, edi
lea eax, [ebp - 0x220]
sar edx, 1
push edx
push eax
call fcn.00402d70
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x4094e8
lea edx, [ebp - 0x220]
lea ecx, [esi + 0xa0]
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x409400
sub edx, edi
lea eax, [ebp - 0x220]
sar edx, 1
push edx
push eax
call fcn.00402d70
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], 1
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x228], 0x104
push eax
lea eax, [ebp - 0x224]
push eax
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4094e8
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4094e8
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409480
sub ecx, edx
sar ecx, 1
cmp ecx, 2
jle 0x4094e8
cmp word [ebp - 0x21e], 0x3a
jne 0x4094c1
cmp word [ebp + ecx*2 - 0x222], 0x5c
jne 0x4094c1
lea eax, [ecx*2 - 2]
cmp eax, 0x21c
jae 0x4094fa
xor ecx, ecx
mov word [ebp + eax - 0x220], cx
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0xa4]
call fcn.00402e70
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.005322c6
mov esp, ebp
pop ebp
ret
call fcn.005328ca
int3
Function at 0x409960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5b21b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x5bdf8c]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00535060
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call fcn.00535060
add esp, 0x18
mov dword [ebp - 0x420], 1
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0x104
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x409a02
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.BkavTlInvoker.log
lea eax, [ebp - 0x210]
push eax
push str._sAppLog_s
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.00532c40
lea eax, [ebp - 0x41c]
push eax
push 0x104
push esi
call fcn.005336e5
add esp, 0x20
push str.LocalWriteLogTlInvoker
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
xor ecx, ecx
mov dword [esi + 0x20c], eax
test eax, eax
pop esi
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005322c6
mov esp, ebp
pop ebp
ret