joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dcd8
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push str.K7ScnEng.dll
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x49caac], eax
cmp eax, edi
je 0x40deeb
push ebx
push esi
push 0x104
mov ebx, 0x49c650
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.K7ScnEng_DefDatabaseLoad
push dword [0x49caac]
call esi
mov dword [0x49cab0], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_DefDatabaseUnLoad
push dword [0x49caac]
call esi
mov dword [0x49cab4], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_DefDatabaseGetInfo1
push dword [0x49caac]
call esi
mov dword [0x49cab8], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_ScanHandleAllocate
push dword [0x49caac]
call esi
mov dword [0x49cabc], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_ScanHandleRelease
push dword [0x49caac]
call esi
mov dword [0x49cac0], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_ScanFileOnDiskA
push dword [0x49caac]
call esi
mov dword [0x49cac4], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_ScanFileOnDiskW
push dword [0x49caac]
call esi
mov dword [0x49cac8], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_ScanUsingHandle
push dword [0x49caac]
call esi
mov dword [0x49cacc], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_IsHandleScannable
push dword [0x49caac]
call esi
mov dword [0x49cad0], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_ScanMBRBootSector
push dword [0x49caac]
call esi
mov dword [0x49cad4], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_SetEngOptions
push dword [0x49caac]
call esi
mov dword [0x49cad8], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_SetEngSettings
push dword [0x49caac]
call esi
mov dword [0x49cadc], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_SetThreatIdStatus
push dword [0x49caac]
call esi
mov dword [0x49cae0], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_SetThreatFlags
push dword [0x49caac]
call esi
mov dword [0x49cae4], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_SetMacroScanFlags
push dword [0x49caac]
call esi
mov dword [0x49cae8], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_CreateFileHandle
push dword [0x49caac]
call esi
mov dword [0x49caec], eax
cmp eax, edi
je 0x40dee9
push str.K7ScnEng_CloseFileHandle
push dword [0x49caac]
call esi
mov dword [0x49caf0], eax
cmp eax, edi
je 0x40dee9
push edi
push edi
push 3
push edi
push 3
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40dee6
push 0x49c648
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
inc edi
pop esi
pop ebx
mov eax, edi
pop edi
ret

Function at 0x40deef
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
test esi, esi
jle 0x40df0f
movzx ecx, byte [edx]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x499100]
inc edx
dec esi
jne 0x40def6
pop esi
ret
Function at 0x40e755
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
lea eax, [ebp - 0x24]
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov dword [0x4990f4], eax
add eax, eax
push eax
push 0x2837
call fcn.0040f7f2
pop ecx
pop ecx
mov dword [0x49ca98], eax
test eax, eax
je 0x40e7fb
push esi
push edi
push 0x49c958
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.0040d53e
xor esi, esi
inc esi
mov edi, 0x49c970
test eax, eax
je 0x40e7c3
push edi
call fcn.0040e4bb
pop ecx
test eax, eax
je 0x40e7c3
push ebx
mov dword [0x49ca84], esi
call fcn.0046feb9
pop ecx
mov dword [0x49ca88], eax
cmp dword [0x49ca84], ebx
jne 0x40e7d6
push edi
call fcn.00403c0e
pop ecx
test eax, eax
je 0x40e7f9
call fcn.0040dcd8
test eax, eax
je 0x40e7f9
mov eax, dword [str.wndClassK7SentryMngr]
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [0x49ca74], eax
mov dword [0x49ca78], esi
mov ebx, esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x40ef37
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [0x49ca78]
push ebx
xor ebx, ebx
xor eax, eax
test ecx, ecx
je 0x40f011
push esi
mov esi, dword [0x4990f4]
add esi, esi
mov dword [0x49ca90], ebx
cmp esi, 0x40
jbe 0x40ef66
push 0x40
pop esi
mov dword [0x49ca94], ebx
cmp esi, ebx
jbe 0x40efd2
push edi
push ebx
push ebx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
call dword [0x49cabc]
test eax, eax
je 0x40efd1
mov edi, dword [ebp - 8]
mov eax, dword [0x49ca94]
mov dword [eax*4 + 0x49c758], edi
call fcn.0040e800
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp - 8]
push 0x40e8ec
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x49ca94]
mov dword [ecx*4 + 0x49c858], eax
cmp eax, ebx
je 0x40efcb
inc ecx
mov dword [0x49ca94], ecx
cmp ecx, esi
jb 0x40ef71
jmp 0x40efd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [ebp - 4], ebx
pop esi
cmp dword [0x49ca94], ebx
jbe 0x40f00e
push dword [0x49ca98]
call fcn.0040f849
pop ecx
cmp eax, ebx
je 0x40f008
push eax
call fcn.004112b8
test eax, eax
je 0x40f008
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x49ca94]
jb 0x40efde
jmp 0x40f00e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
inc eax
pop ebx
leave
ret
Function at 0x40f958
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0x398], eax
push ebx
lea eax, [ebp - 0x68]
xor ebx, ebx
push eax
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x68], bl
call fcn.00401f60
pop ecx
cmp byte [ebp - 0x68], bl
je 0x40fb05
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.AVDefs
lea eax, [ebp - 0x68]
push eax
call esi
push str.K7NfXRlS.DSM
lea eax, [ebp - 0x68]
push eax
call esi
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocString
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x6c], esi
cmp esi, 0xffffffff
je 0x40fb04
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x70], eax
cmp eax, 0x60
jb 0x40faf5
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 8
lea eax, [ebp - 0x80]
push 0x49cbe8
push eax
call fcn.0046c7d5
add esp, 0xc
test eax, eax
jne 0x40fa2c
cmp dword [0x49cbf0], ebx
je 0x40faf5
cmp dword [0x49cbf4], ebx
je 0x40faf5
mov dword [ebp - 0x74], 1
jmp 0x40faf5
push edi
push dword [ebp - 0x70]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x40faf4
push ebx
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
push esi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fae5
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x70]
or dword [ebp - 0x6c], 0xffffffff
add eax, esi
cmp dword [esi], 0x4b374e57
mov dword [ebp - 0x78], eax
jne 0x40fae5
cmp dword [esi + 4], 3
jne 0x40fae5
mov eax, dword [0x49cbf0]
mov dword [0x49cbf4], ebx
cmp eax, ebx
je 0x40faa2
push eax
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esi + 0x50]
add eax, esi
xor edx, edx
jmp 0x40fac9
cmp edx, dword [esi + 0x54]
jae 0x40face
cmp byte [eax], bl
je 0x40face
xor ecx, ecx
cmp byte [eax], bl
je 0x40fac4
add byte [ecx + eax], 0xf9
inc ecx
cmp byte [ecx + eax], bl
jne 0x40faba
lea eax, [eax + ecx + 1]
inc edx
cmp eax, dword [ebp - 0x78]
jb 0x40faab
mov eax, dword [ebp - 0x70]
mov dword [0x49cbf0], esi
mov dword [0x49cbf4], eax
xor esi, esi
mov dword [ebp - 0x74], 1
cmp esi, ebx
je 0x40faf4
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
cmp dword [ebp - 0x6c], 0xffffffff
je 0x40fb04
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp + 0x398]
mov eax, dword [ebp - 0x74]
xor ecx, ebp
pop ebx
call fcn.0046c1d2
add ebp, 0x39c
leave
ret
Function at 0x40fbd4
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40fd41
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, 0x1000
mov dword [ebp - 0x10], eax
cmp eax, edi
jb 0x40fd24
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x40fd22
mov eax, dword [ebp - 8]
lea edx, [eax + esi]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x40fd22
mov eax, dword [esi + 0x3c]
cmp eax, dword [ebp - 0x10]
ja 0x40fd22
lea eax, [eax + esi + 4]
lea ecx, [eax + 0x18]
cmp ecx, edx
jbe 0x40fca9
push 0
push 0
push dword [esi + 0x3c]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
push eax
push edi
push esi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x40fd22
mov eax, dword [ebp - 8]
test eax, eax
je 0x40fd22
lea edx, [eax + esi]
lea eax, [esi + 4]
lea ecx, [eax + 0x18]
cmp ecx, edx
ja 0x40fd22
cmp dword [eax - 4], 0x4550
jne 0x40fd22
movzx ecx, word [eax]
mov edi, 0x14c
mov ebx, edi
cmp bx, cx
je 0x40fcd2
mov ebx, 0x8664
cmp bx, cx
jne 0x40fd22
test byte [eax + 0x12], 2
je 0x40fd22
cmp di, cx
jne 0x40fcf1
lea ecx, [eax + 0x14]
movzx eax, word [eax + 0x10]
add eax, ecx
cmp eax, edx
ja 0x40fd22
mov eax, 0x10b
jmp 0x40fd0d
mov edi, 0x8664
cmp di, cx
jne 0x40fd22
lea ecx, [eax + 0x14]
movzx eax, word [eax + 0x10]
add eax, ecx
cmp eax, edx
ja 0x40fd22
mov eax, 0x20b
cmp ax, word [ecx]
jne 0x40fd22
push 2
pop eax
cmp ax, word [ecx + 0x44]
jne 0x40fd22
mov dword [ebp - 0xc], 1
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
cmp esi, ebx
je 0x40fd41
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret
Function at 0x4103c7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 1]
xor ebx, ebx
push eax
xor edi, edi
xor esi, esi
mov dword [ebp - 8], ebx
mov byte [ebp - 1], 1
call fcn.00404cbd
pop ecx
cmp byte [ebp - 1], bl
je 0x410460
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x410460
push esi
lea edi, [esi + 0x800]
mov byte [esi], bl
call fcn.004037a0
mov dword [esp], str.K7AVQrnt.exe
push esi
push str._s_s__rescanrestore
push edi
call fcn.0046ec88
add esp, 0x10
lea eax, [ebp - 8]
push eax
push ebx
push edi
call fcn.0046bc60
mov edi, eax
cmp edi, 1
jne 0x410460
push 0xdbba0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41045d
push 0xdeaddead
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edi, edi
inc edi
cmp dword [ebp - 8], ebx
je 0x41046e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x410481
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x410488
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ecx
push ebx
xor ebx, ebx
mov dword [esp + 8], ebx
mov byte [esp + 7], bl
cmp dword [0x49c468], ebx
jne 0x41054f
cmp dword [0x49c46c], ebx
jne 0x41054f
cmp dword [0x49c44c], ebx
jne 0x41054f
lea eax, [esp + 7]
push esi
push eax
call fcn.00404c3c
mov dword [esp], 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x41054e
push ebp
push edi
push esi
lea ebp, [esi + 0x800]
mov byte [esi], bl
call fcn.004037a0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [esp], 0x494bb0
push esi
call edi
push str.K7CTScan.exe
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41053d
cmp byte [esp + 0x13], bl
je 0x410520
push str.__update
jmp 0x410525
push str.__build
push esi
call edi
push esi
push ebp
call fcn.0046eb90
pop ecx
pop ecx
push ebx
push ebx
push ebp
call fcn.0046bc60
mov dword [esp + 0x14], eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebp
pop esi
mov eax, dword [esp + 8]
pop ebx
pop ecx
pop ecx
ret
Function at 0x4105f7
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x400
lea eax, [ebp - 0x404]
push eax
mov byte [ebp - 0x404], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.Temp
lea eax, [ebp - 0x404]
push eax
call esi
push str.K7SVSDsm
lea eax, [ebp - 0x404]
push eax
call esi
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop esi
cmp eax, 0xffffffff
je 0x410666
push ebx
lea ebx, [ebp - 0x404]
call fcn.0040d5d4
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.0046c1d2
leave
ret

Function at 0x410675
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x4b8]
sub esp, 0x538
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0x4b4], eax
mov eax, dword [ebp + 0x4c0]
and dword [ebp - 0x70], 0
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x4c4]
push edi
push eax
lea eax, [ebp + 0x394]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.USER32.dll_CharLowerA]
lea eax, [ebp + 0x394]
push eax
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
jne 0x4106dc
mov dword [ebp - 0x70], 1
jmp 0x41078a
and dword [ebp - 0x74], 0
push esi
mov dword [ebp - 0x78], 1
mov esi, 0x400
push dword [ebp - 0x78]
lea eax, [ebp + 0x494]
push 0x494e0c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
inc dword [ebp - 0x78]
push ebx
push esi
lea eax, [ebp - 0x6c]
push eax
push 0x4946fa
lea eax, [ebp + 0x494]
push eax
push str.InstallFiles
mov byte [ebp - 0x6c], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x41076a
cmp byte [ebp - 0x6c], 0
je 0x41076a
lea eax, [ebp - 0x6c]
push eax
call edi
lea eax, [ebp + 0x394]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0046e7b0
pop ecx
pop ecx
test eax, eax
je 0x4106ed
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push eax
push eax
lea eax, [ebp - 0x6c]
push str._lu__lu__lu__lu_
push eax
call fcn.0046e065
add esp, 0x18
cmp dword [ebp - 0x74], 0
je 0x410782
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x80]
call fcn.0046bd50
cmp dword [ebp - 0x74], eax
jne 0x410789
mov dword [ebp - 0x70], 1
pop esi
mov ecx, dword [ebp + 0x4b4]
mov eax, dword [ebp - 0x70]
xor ecx, ebp
pop edi
call fcn.0046c1d2
add ebp, 0x4b8
leave
ret
Function at 0x4107a3
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0x88], eax
mov eax, dword [ebp + 0x94]
push ebx
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push SysReAllocString
push eax
mov dword [ebp - 0x7c], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x410869
push esi
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.0046e3e0
add esp, 0xc
push edi
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x78]
push eax
push ebx
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
test eax, eax
je 0x410862
cmp dword [ebp - 0x80], 0x40
jb 0x410862
cmp dword [ebp - 0x78], 0x301f562
je 0x41085b
push dword [0x499704]
lea eax, [ebp - 0x78]
push str.K7AntiVirus_Data_File_Version__c__K7_Computing._r_nFileFormat_Version:10.10_r_n
push eax
call fcn.0046c7d5
add esp, 0xc
test eax, eax
je 0x41085b
push dword [0x499754]
lea eax, [ebp - 0x78]
push str.K7AntiVirus_Data_File_Version__c__K7_Computing._r_nFileFormat_Version:08.10_r_n
push eax
call fcn.0046c7d5
add esp, 0xc
test eax, eax
jne 0x410862
mov dword [ebp - 0x7c], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x88]
mov eax, dword [ebp - 0x7c]
pop edi
xor ecx, ebp
pop ebx
call fcn.0046c1d2
add ebp, 0x8c
leave
ret
Function at 0x410883
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0xb94]
sub esp, 0xc14
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0xb90], eax
mov eax, dword [ebp + 0xb9c]
and dword [eax], 0
and dword [ebp - 0x78], 0
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push str.K7AVSIGN.INF
push ecx
mov dword [ebp - 0x7c], eax
mov edi, 0x4946f4
lea eax, [ebp + 0x390]
push edi
push eax
mov dword [ebp - 0x80], ecx
mov ebx, edx
call esi
push str.FileList.Ini
push 0x4847f0
push ebx
lea eax, [ebp - 0x70]
push str._s_s_s
push eax
call esi
lea eax, [ebp + 0x390]
push 0x4868d4
push eax
call fcn.004703be
add esp, 0x2c
mov dword [ebp - 0x74], eax
test eax, eax
je 0x4109ed
push eax
jmp 0x4109cf
push dword [ebp - 0x74]
lea eax, [ebp + 0x790]
push 0x400
push eax
mov byte [ebp + 0x790], 0
call fcn.004701b2
lea eax, [ebp + 0x790]
push 0xd
push eax
call fcn.0046fa00
add esp, 0x14
test eax, eax
je 0x41093f
mov byte [eax], 0
lea eax, [ebp + 0x790]
push 0xa
push eax
call fcn.0046fa00
pop ecx
pop ecx
test eax, eax
je 0x410956
mov byte [eax], 0
cmp byte [ebp + 0x790], 0x3b
je 0x4109cc
cmp byte [ebp + 0x790], 0
je 0x4109cc
lea eax, [ebp + 0x790]
push 0x3d
push eax
call fcn.0046fa00
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4109dd
inc ebx
push ebx
push dword [ebp - 0x80]
lea eax, [ebp + 0x390]
push edi
push eax
call esi
lea eax, [ebp + 0x390]
push eax
call fcn.004107a3
add esp, 0x14
test eax, eax
je 0x4109b6
push ebx
lea eax, [ebp + 0x390]
push eax
lea ebx, [ebp - 0x70]
call fcn.00410675
pop ecx
pop ecx
test eax, eax
jne 0x4109cc
mov eax, dword [ebp - 0x7c]
mov dword [eax], 1
lea eax, [ebp + 0x390]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x74]
call fcn.0046fffa
pop ecx
test eax, eax
je 0x41090c
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 1
call fcn.0046ff7e
pop ecx
mov ecx, dword [ebp + 0xb90]
mov eax, dword [ebp - 0x78]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046c1d2
add ebp, 0xb94
leave
ret
Function at 0x410a47
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push 0x2000
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x410bc7
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
mov esi, 0x20019
push esi
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x410bb4
mov eax, dword [ebp - 8]
add eax, 0x400
lea ecx, [ebp - 0xc]
push ecx
push eax
mov byte [eax], bl
lea eax, [ebp - 0x18]
push eax
push ebx
push str.DirProductBase
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x410bb4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push str.SOFTWAREK7_ComputingCommonInfoAntiVirus
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x410bb4
mov esi, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
mov byte [esi], bl
push str.VDefPath
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x410bb4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 0x400]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
mov dword [ebp - 4], ebx
call esi
cmp eax, 0xffffffff
je 0x410bb4
push dword [ebp - 8]
call esi
cmp eax, 0xffffffff
je 0x410bb4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
add edx, 0x400
mov dword [ebp - 0x10], ebx
call fcn.00410883
pop ecx
test eax, eax
je 0x410bb4
cmp dword [ebp - 0x10], ebx
je 0x410bb4
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdates
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x410bb4
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push str.VersionAVScript
push dword [ebp - 4]
xor esi, esi
inc esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x410bb4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
cmp dword [ebp - 4], ebx
pop ebx
je 0x410bd6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x410bdb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x1000
call fcn.0046e0d4
mov edi, eax
pop ecx
test edi, edi
je 0x410d26
push ebx
push edi
call fcn.004037a0
xor ebx, ebx
inc ebx
pop ecx
cmp eax, ebx
jne 0x410d19
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.Updates
push edi
call esi
push str.UpdtFile.Ini
push edi
call esi
push edi
push 6
lea eax, [ebp - 0x10]
push eax
push 0x4946fa
push str.DatUpdated
push str.Info
mov byte [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x10], 0x31
jne 0x410d18
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.00410388
pop ecx
pop ecx
test eax, eax
je 0x410d18
push 8
mov esi, 0x49cc00
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0046c7d5
add esp, 0xc
test eax, eax
je 0x410d18
push 8
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.0046c470
add esp, 0xc
call fcn.00410a47
test eax, eax
je 0x410ca4
call fcn.00410a08
jmp 0x410d18
push 0
call fcn.0046feb9
pop ecx
mov ecx, eax
sub ecx, dword [0x49cbfc]
cmp ecx, 5
jb 0x410d18
push ebx
mov dword [0x49cbfc], eax
call fcn.00405c63
mov dword [esp], 0x499700
call fcn.004115b3
xor eax, eax
cmp dword [0x499700], ebx
push ebx
setne al
inc eax
mov dword [0x499700], eax
call fcn.00411703
call fcn.0041058e
cmp eax, ebx
jne 0x410cfe
lea eax, [ebp - 0x1c]
push eax
call fcn.004116d1
call fcn.0040f014
push 0
call fcn.00411703
call fcn.00410557
cmp eax, ebx
je 0x410d18
call fcn.004103c7
call fcn.00410488
pop esi
call fcn.004165ba
push edi
call fcn.0046c1c7
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.0046c1d2
leave
ret

Function at 0x410d5c
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push edi
xor ebx, ebx
push ebx
push 1
mov edi, 0x49cbf8
push edi
call esi
test eax, eax
jne 0x410d9e
lea eax, [esp + 0xc]
push eax
push ebx
push ebx
push 0x410d35
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x410d98
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x410d9e
push 1
push ebx
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret