joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425d00
Capabilities:
Get common file path

Disassembly:
mov eax, 0x2460
call fcn.0044e2b0
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x245c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x246c]
push esi
mov esi, ecx
cmp dword [esi + 0x41c], 0
push edi
push 0x104
jne 0x425d43
lea eax, [esp + 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x425d51
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
je 0x425ea0
lea edx, [esp + 0x230]
push str.BkavService.exe
push edx
mov ebx, 0x1000
lea edi, [esp + 0x458]
call fcn.0040def0
add esp, 8
test eax, eax
je 0x425d8f
mov eax, edi
mov ebx, ebp
call fcn.00425c40
test eax, eax
je 0x425ea0
lea eax, [esp + 0x230]
push str.BluProService.exe
push eax
mov ebx, 0x1000
lea edi, [esp + 0x458]
call fcn.0040def0
add esp, 8
test eax, eax
je 0x425dc5
mov eax, edi
mov ebx, ebp
call fcn.00425c40
test eax, eax
je 0x425ea0
cmp dword [esi + 0x41c], 0
jne 0x425df4
lea ecx, [esp + 0x230]
push str.BkavFirewallService.exe
push ecx
mov ebx, 0x1000
lea edi, [esp + 0x458]
call fcn.0040def0
add esp, 8
jmp 0x425e8e
add esi, 6
push esi
lea edx, [esp + 0x14]
push 0x10e
push edx
call fcn.0043efc3
lea edi, [esp + 0x1c]
add esp, 0xc
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x425e11
mov eax, dword [0x4576d8]
mov dword [edi], eax
lea eax, [esp + 0x10]
add eax, 0xfffffffe
jmp 0x425e30
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x425e30
mov ecx, dword [str.System]
mov edx, dword [0x48369c]
mov dword [eax], ecx
mov ecx, dword [0x4836a0]
mov dword [eax + 4], edx
mov dx, word [0x4836a4]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x10]
push eax
push str.szSystemBkavDir___ws_n
call fcn.00404c20
lea ecx, [esp + 0x18]
push 0x457934
push ecx
mov ebx, 0x1000
lea edi, [esp + 0x460]
call fcn.0040def0
add esp, 0x10
test eax, eax
je 0x425ea0
lea eax, [esp + 0x450]
mov ebx, ebp
call fcn.00425c40
mov ecx, dword [esp + 0x246c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x2460
ret 4

Function at 0x425ec0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x425f43
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x425f00
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0x10
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x24
ret
Function at 0x426260
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x11c], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 6
jae 0x4262ae
mov dword [esi + 0x418], 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x120
ret
jne 0x4262f3
mov eax, dword [esp + 8]
sub eax, 0
je 0x4262e9
sub eax, 1
jne 0x4262f3
xor ecx, ecx
cmp byte [esp + 0x11a], 1
sete cl
add ecx, 3
mov dword [esi + 0x418], ecx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x120
ret
mov dword [esi + 0x418], 2
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x120
ret
Function at 0x4265a0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x48a2f0
push 0x441f50
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x48e050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x450], 0xffffffff
xor edi, edi
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0x448], edi
push 0x424
push edi
lea eax, [ebp - 0x444]
push eax
call fcn.004416b0
add esp, 0xc
mov dword [ebp - 4], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x450], esi
cmp esi, 0xffffffff
jne 0x42663a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateToolhelp32Snapshot_error:__d
call fcn.00404c20
add esp, 8
jmp 0x4266a5
mov dword [ebp - 0x448], 0x428
lea ecx, [ebp - 0x448]
push ecx
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x426670
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Module32First_error:__d
call fcn.00404c20
add esp, 8
jmp 0x4266a5
push str.BkavFirewallEngine.dll
lea edx, [ebp - 0x428]
push edx
call fcn.0043ec25
add esp, 8
test eax, eax
jne 0x426694
mov dword [ebp - 0x44c], 1
jmp 0x4266a5
lea eax, [ebp - 0x448]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x426670
mov dword [ebp - 4], 0xfffffffe
call fcn.004266d9
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret
Function at 0x426890
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x453086
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
push ebp
push edi
mov eax, dword [0x48e050]
xor eax, esp
push eax
lea eax, [esp + 0x1ac]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1bc]
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], cx
push ebx
push 0x80
push 3
push ebx
push ebx
push bind
push eax
mov dword [esp + 0x1d0], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x426a5f
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea edx, [esp + 0x18]
push edx
push 0x30
lea ecx, [esp + 0x78]
push ecx
push eax
call ebp
cmp eax, ebx
je 0x426a4b
cmp dword [esp + 0x14], 0x30
jne 0x426a4b
mov eax, dword [esp + 0x98]
lea edx, [eax + eax*2]
add edx, edx
add edx, edx
add edx, edx
cmp dword [esp + 0x90], edx
jne 0x426a4b
xor edi, edi
cmp eax, ebx
jbe 0x426a4b
jmp 0x42696a
xor ebx, ebx
mov edx, dword [esi]
xor eax, eax
push ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x18]
push eax
push 0x18
lea ecx, [esp + 0x40]
push ecx
push edx
call ebp
cmp eax, ebx
je 0x426a4b
cmp dword [esp + 0x14], 0x18
jne 0x426a4b
push 0x103
lea eax, [esp + 0xa1]
push ebx
push eax
mov byte [esp + 0xa8], bl
call fcn.004416b0
lea ecx, [esp + 0xa8]
add esp, 0xc
push ecx
lea ebx, [esp + 0x3c]
call fcn.004091c0
add esp, 4
lea edx, [esp + 0x9c]
push edx
lea ecx, [esp + 0x1c]
call fcn.00404500
lea eax, [esp + 0x18]
push eax
lea ebx, [esi + 0x20c]
mov byte [esp + 0x1b8], 1
call fcn.00426f60
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
mov edx, dword [esp + 0x38]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x40]
mov dword [eax + 0xc], edx
mov ecx, dword [esp + 0x44]
mov dword [eax + 0x10], ecx
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x18]
mov dword [eax + 0x14], edx
mov byte [esp + 0x1b4], 0
call fcn.00403dc0
inc edi
cmp edi, dword [esp + 0x98]
jb 0x426968
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x426a5f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov ecx, dword [esp + 0x1ac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x1a8
ret 4
Function at 0x426ac0
Capabilities:
Check if file exists
Copy file
Delete file
Query or enumerate registry value

Disassembly:
sub esp, 0x434
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x430], eax
push esi
push edi
xor eax, eax
push 0x208
mov esi, ecx
push eax
lea ecx, [esp + 0x22e]
push ecx
mov word [esp + 0x230], ax
call fcn.004416b0
add esp, 0xc
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x1e]
push eax
mov word [esp + 0x20], dx
call fcn.004416b0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x228]
push edx
lea eax, [esp + 0x14]
push eax
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x426bc8
push 0x483940
lea ecx, [esp + 0x228]
push ecx
push 0x47903c
lea edx, [esp + 0x20]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x14
push str.SystemFirewallBkavBN.dat
lea eax, [esp + 0x228]
push eax
push 0x47903c
lea edi, [esi + 4]
push 0x104
push edi
call fcn.0043ed50
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x426bc2
push 0
push edi
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
jne 0x426bc2
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call fcn.00426890
mov ecx, dword [esp + 0x438]
pop edi
pop esi
xor ecx, esp
call fcn.0043e4c7
add esp, 0x434
ret
Function at 0x428420
Capabilities:
Create directory

Disassembly:
sub esp, 8
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push edi
push 0x208
lea edi, [esi + 0xec4]
push 0
push edi
call fcn.004416b0
add esp, 0xc
push 0x208
lea ebp, [esi + 0x10e0]
push 0
push ebp
call fcn.004416b0
add esp, 0xc
push 0x208
lea eax, [esi + 0x12fc]
push 0
push eax
call fcn.004416b0
add esp, 0xc
push 0x208
lea eax, [esi + 0x1518]
push 0
push eax
call fcn.004416b0
add esp, 0xc
push 0x208
push 0
push 0x492d30
call fcn.004416b0
add esp, 0xc
lea ebx, [esi + 0x44c]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4284b6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.ProactiveFileMapping_List
call fcn.00404db0
add esp, 4
push str.ProactiveProgramName
mov edi, ebp
call fcn.00404db0
add esp, 4
push 0x457eec
lea edi, [esi + 0x12fc]
call fcn.00404db0
add esp, 4
push str.UserProactiveDomainBlackList
lea edi, [esi + 0x1518]
call fcn.00404db0
add esp, 4
push 0x457f5c
mov edi, 0x492d30
call fcn.00404db0
add esp, 4
push 0x483994
push ebx
push 0x47903c
lea edi, [esi + 0x512c8]
push 0x104
push edi
call fcn.0043ed50
add esp, 0x14
push 0x224
lea edx, [esi + 0x50db0]
mov ecx, str.PADATA
mov eax, edi
call fcn.00403510
mov edi, eax
test edi, edi
jne 0x428567
push str.LoadList_Ak_fail__n
call fcn.00404c20
add esp, 4
xor eax, eax
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0043e4c7
add esp, 8
ret
mov ecx, esi
call fcn.00428dd0
push esi
call fcn.0042a8c0
test eax, eax
jne 0x428585
push str.InitDomainBlackList_error
call fcn.00404c20
add esp, 4
mov ebx, esi
call fcn.0042ab30
test eax, eax
jne 0x42859d
push str.InitDomainWhiteList_error
call fcn.00404c20
add esp, 4
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 8
ret
Function at 0x4285c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4529c8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x48e050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
lea ebx, [esp + 0xc]
mov esi, ecx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0xc], vtable.CMd5Hash.0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call fcn.0040af10
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov byte [esp + 0x1c], bl
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov word [esp + 0x29], ax
mov byte [esp + 0x2b], al
cmp edi, ebx
jne 0x428667
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], vtable.CMd5Hash.0
cmp eax, ebx
je 0x428651
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4286e6
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x4286e6
lea eax, [esp + 0x18]
push eax
push edi
call fcn.00428710
cmp eax, ebx
je 0x4286a5
movzx esi, byte [eax + 8]
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], vtable.CMd5Hash.0
cmp eax, ebx
je 0x428691
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4286a1
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x4286e8
lea ecx, [esp + 0x1c]
push ecx
mov edx, edi
lea ecx, [esp + 0x10]
call fcn.0040af90
cmp eax, 0xffffffff
je 0x4286dd
push esi
lea ecx, [esp + 0x1c]
lea ebx, [esp + 0x20]
call fcn.004288b0
test eax, eax
je 0x4286dd
movzx esi, byte [eax + 8]
lea ecx, [esp + 0xc]
call fcn.0040aed0
mov eax, esi
jmp 0x4286e8
lea ecx, [esp + 0xc]
call fcn.0040aed0
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x30
ret
Function at 0x428dd0
Capabilities:
Delete file
Read file on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push ebp
push esi
xor eax, eax
push edi
xor edi, edi
push 0x208
mov esi, ecx
lea ecx, [esp + 0x52]
push edi
push ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov word [esp + 0x58], ax
call fcn.004416b0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0xc
push edi
push 0x80
push 3
push edi
push 1
lea ebp, [esi + 0xec4]
push bind
push ebp
mov dword [esp + 0x38], ebp
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x428e7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.CreateFile__ws_fail__d_n
call fcn.00404c20
add esp, 0xc
xor eax, eax
jmp 0x428f83
push 0
push 0x80
push 3
push 0
push 1
lea ebp, [esi + 0x10e0]
push bind
push ebp
mov dword [esp + 0x34], ebp
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x428ec5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.CreateFile__ws_fail__d_n
call fcn.00404c20
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x428f83
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [esp + 0x18]
push edx
push 0x2c
lea eax, [esp + 0x2c]
push eax
push edi
call ebp
test eax, eax
je 0x428f45
cmp dword [esp + 0x14], 0x2c
jne 0x428f45
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x20a
lea edx, [esp + 0x58]
push edx
push ebx
call ebp
test eax, eax
je 0x428f9c
cmp dword [esp + 0x14], 0x20a
jne 0x428f9c
mov ecx, dword [esp + 0x38]
push ecx
lea edx, [esp + 0x3d]
xor eax, eax
push edx
lea edx, [esp + 0x54]
mov ecx, esi
mov word [esp + 0x25c], ax
call fcn.004289d0
push 0
lea eax, [esp + 0x18]
push eax
push 0x2c
lea ecx, [esp + 0x2c]
push ecx
push edi
call ebp
test eax, eax
jne 0x428ee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esp + 0x20]
push eax
push str.ReadFile__ws_fail__d_n
call fcn.00404c20
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push edi
call esi
push ebx
call esi
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
mov eax, 1
mov ecx, dword [esp + 0x260]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x254
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
push eax
push edx
jmp 0x428f51
Function at 0x42ab30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x178
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x174], eax
push ebp
xor eax, eax
push esi
push edi
xor edi, edi
push 0x12a
lea ecx, [esp + 0x42]
push edi
push ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov word [esp + 0x48], ax
call fcn.004416b0
add esp, 0xc
push edi
push 0x80
push 3
push edi
xor eax, eax
push 1
push bind
push 0x492d30
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], eax
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], eax
mov word [esp + 0x194], ax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42ac0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x492d30
push str.Createfile__ws_fail__d_n
call fcn.00404c20
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x174]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x178
ret
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea edx, [esp + 0x10]
push edx
push 0x2c
lea eax, [esp + 0x1c]
push eax
push esi
call ebp
test eax, eax
je 0x42ac8a
cmp dword [esp + 0xc], 0x2c
jne 0x42ac8a
mov cl, byte [esp + 0x28]
mov edx, dword [esp + 0x29]
mov eax, dword [esp + 0x2d]
mov byte [esp + 0x168], cl
mov ecx, dword [esp + 0x31]
mov dword [esp + 0x169], edx
mov edx, dword [esp + 0x35]
mov dword [esp + 0x16d], eax
lea edi, [ebx + 0x51730]
lea eax, [esp + 0x3c]
mov dword [esp + 0x171], ecx
mov dword [esp + 0x175], edx
call fcn.0042d4e0
push 0
lea eax, [esp + 0x10]
push eax
push 0x2c
lea ecx, [esp + 0x1c]
push ecx
push esi
call ebp
test eax, eax
jne 0x42ac28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x492d30
push str.ReadFile__ws_fail__d_n
call fcn.00404c20
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x180]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0043e4c7
add esp, 0x178
ret
Function at 0x42c520
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
call fcn.00405460
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x50da8], eax
test eax, eax
je 0x42c586
lea edx, [esp + 8]
push edx
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.fFirewallAskUser
push str.SoftwareBkav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42c591
cmp dword [esp + 4], eax
je 0x42c591
push str.Enable_Ask_FW_n
call fcn.00404c20
add esp, 4
mov eax, 1
add esp, 0x10
ret 4
push str.Disable_Ask_FW_n
call fcn.00404c20
add esp, 4
xor eax, eax
add esp, 0x10
ret 4

Function at 0x42cce0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x244
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x240], eax
mov eax, dword [esp + 0x248]
push ebx
push esi
push edi
push 0x228
lea ecx, [esp + 0x20]
push 0
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], 0
call fcn.004416b0
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push str..FwDrv0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42cd62
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteAllConnectionCache_Open_device_FW_error:__d
call fcn.00404c20
add esp, 8
xor eax, eax
jmp 0x42ce18
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42cd5b
lea edx, [esp + 0x18]
push edx
push ebx
mov dword [esp + 0x20], 0x22c
call sub.KERNEL32.dll_Process32FirstW
mov edi, eax
test edi, edi
je 0x42ce06
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea eax, [esp + 0x3c]
push 0x104
push eax
call fcn.00440edf
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x44]
push ecx
push edx
call fcn.004403dc
add esp, 0x10
test eax, eax
je 0x42cdf4
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
test eax, eax
je 0x42cdf4
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 4
lea ecx, [esp + 0x20]
push ecx
push 0x22e03e
push esi
call edi
test eax, eax
jne 0x42cdf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.send_IOCTL_DELETE_CONN_CACHE_error:__d
call fcn.00404c20
add esp, 8
lea edx, [esp + 0x18]
push edx
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42cd91
lea edi, [eax + 1]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test ebx, ebx
je 0x42ce16
push ebx
call esi
mov eax, edi
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x244
ret 4
Function at 0x42ce40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x51780], eax
test eax, eax
jne 0x42ce65
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x42c5b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42ce85
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42ce90
push esi
call fcn.0042ca20
push 0x1388
call edi
jmp 0x42ce90
Function at 0x42e590
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x452b72
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x21c], eax
push esi
mov eax, dword [0x48e050]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov dword [esp + 0x230], 0
mov dword [esp + 0xc], 0
mov eax, dword [0x491d10]
mov edx, dword [eax + 0xc]
mov esi, ecx
mov ecx, 0x491d10
mov dword [esp + 0x14], esi
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x230], 0
mov eax, 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x10]
push edx
push str.szBSPCDir
push str.SOFTWAREBkav_CorporationBSPC
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42e657
push str.PWeb.dat
lea eax, [esp + 0x1c]
push eax
push 0x47903c
push esi
call fcn.0041c5e0
add esp, 0x10
jmp 0x42e65c
call fcn.00401660
mov eax, esi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x22c
ret