joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410300
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x45c
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x458], eax
push esi
push edi
xor eax, eax
push 0x21a
push eax
lea ecx, [esp + 0x26]
push ecx
mov word [esp + 0x28], ax
call fcn.004416b0
add esp, 0xc
xor edx, edx
push 0x21a
push edx
lea eax, [esp + 0x246]
push eax
mov word [esp + 0x248], dx
call fcn.004416b0
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x240]
push edx
lea eax, [esp + 0x1c]
push eax
push str.InstallPath
push str.SYSTEMCurrentControlSetServicesBkavDC
mov edi, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], 0x21c
call esi
test eax, eax
je 0x4103fd
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 0x208
call esi
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4103c1
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
push str.InstallPath
push str.SYSTEMCurrentControlSetServicesBkavDC
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.BkavDC
call fcn.00408840
add esp, 4
call fcn.00410480
mov esi, str.BkavSdFlt
test eax, eax
je 0x410432
xor edi, edi
call fcn.00410780
mov esi, str.BkavDC
call fcn.00410780
mov esi, str.BkavSDF
call fcn.00410780
call fcn.00410530
push str.InitRunSafeMode_for_BkavDC
jmp 0x410455
call fcn.00410780
mov esi, str.BkavDC
call fcn.00410780
mov esi, str.BkavSDF
call fcn.00410780
call fcn.004106b0
push str.InitRunNormal_for_BkavDC
call fcn.00404c20
mov ecx, dword [esp + 0x464]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.0043e4c7
add esp, 0x45c
ret

Function at 0x410480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x16]
push ecx
mov dword [esp + 0xc], 0
mov word [esp + 0x18], ax
call fcn.004416b0
push str.BkavDC
push str.SYSTEMCurrentControlSetServices_s
lea edx, [esp + 0x20]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x1c
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push str.fRunSafeMode
lea eax, [esp + 0x1c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41050e
mov eax, 1
cmp dword [esp], eax
je 0x410510
xor eax, eax
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x218
ret
Function at 0x410530
Capabilities:
Manipulate safe mode programs
Set registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004416b0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x222]
push eax
mov word [esp + 0x224], dx
call fcn.004416b0
add esp, 0xc
push str.BkavSystemService
push str.RegisterServiceRunSafeMode:__s
call fcn.00404c20
push str.BkavSystemService
push str.SYSTEMControlSet001ControlSafeBootMinimal_s
lea edx, [esp + 0x20]
call fcn.004028c0
push str.BkavSystemService
push str.SYSTEMControlSet001ControlSafeBootNetwork_s
lea edx, [esp + 0x230]
call fcn.004028c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 0x18
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 4
push 0
push 0
push 0
lea edx, [esp + 0x2c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
jne 0x41062e
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 0xc], eax
setne al
test eax, eax
je 0x41062e
push str.Service
call edi
lea eax, [eax + eax + 2]
push eax
push str.Service
push 1
lea ecx, [esp + 0x1c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 0
lea edx, [esp + 0x10]
push edx
push 0
push 4
push 0
push 0
push 0
lea eax, [esp + 0x234]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0
call esi
test eax, eax
jne 0x410694
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 0xc], eax
setne al
test eax, eax
je 0x410694
push str.Service
call edi
lea eax, [eax + eax + 2]
push eax
push str.Service
push 1
lea edx, [esp + 0x224]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x420
ret

Function at 0x4106b0
Capabilities:
Delete registry key
Manipulate safe mode programs

Disassembly:
sub esp, 0x420
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x418], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004416b0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x21a]
push eax
mov word [esp + 0x21c], dx
call fcn.004416b0
add esp, 0xc
push str.BkavSystemService
push str.UnRegisterServiceRunSafeMode:__s
call fcn.00404c20
push str.BkavSystemService
push str.SYSTEMControlSet001ControlSafeBootMinimal_s
lea edx, [esp + 0x18]
call fcn.004028c0
push str.BkavSystemService
push str.SYSTEMControlSet001ControlSafeBootNetwork_s
lea edx, [esp + 0x228]
call fcn.004028c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0x18
lea ecx, [esp + 8]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea edx, [esp + 0x210]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x41c]
pop esi
xor ecx, esp
call fcn.0043e4c7
add esp, 0x420
ret
Function at 0x410780
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x220
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, 4
push ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov dword [esp + 0x10], 0
mov word [esp + 0x1c], ax
call fcn.004416b0
add esp, 0xc
test esi, esi
je 0x41083e
push esi
push str.SYSTEMCurrentControlSetServices_s
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x10
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
push str.Start
lea eax, [esp + 0x20]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41083e
mov ecx, dword [esp + 4]
push edi
push ecx
push esi
push str.SetStattType:__s___d__d
call fcn.00404c20
add esp, 0x10
cmp dword [esp + 4], edi
je 0x41083e
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x41083e
push edi
push esi
mov ebx, eax
call fcn.00408920
add esp, 8
mov ecx, dword [esp + 0x21c]
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x220
ret

Function at 0x410860
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x234
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x230], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push str.SystemLogReportExLogReportEx.dll
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0043f083
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push str.InitLogReportEx:__s
call fcn.00404c20
add esp, 8
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4108ff
push str.ProcessLog
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4108ff
call eax
push str.End_PFn_LogReport_Start
call fcn.00404c20
add esp, 4
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x234
ret
Function at 0x411030
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0xac
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0xa8], eax
push esi
push str.BkavSystemService
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4110ae
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegisterServiceCtrlHandler
push str._s_failed_with__d
mov ecx, 0x50
lea edi, [esp + 0x1c]
call fcn.00409e80
add esp, 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 2
push 0
push 0xc0020001
push 0
push 1
mov eax, edi
push esi
mov dword [esp + 0x2c], str.BkavSystemService
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
mov ecx, dword [esp + 0xac]
pop esi
xor ecx, esp
call fcn.0043e4c7
add esp, 0xac
ret

Function at 0x4110d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84c
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x848], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 1
xor esi, esi
push esi
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411271
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.szTempDirectory
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x10]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x411271
xor edx, edx
lea eax, [esp + 0x18]
mov word [esp + 0x21e], dx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411160
sub eax, edx
sar eax, 1
je 0x411271
push str.SafeRun
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x411271
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call fcn.00440099
add esp, 8
test eax, eax
je 0x411271
add eax, 2
push 0x5c
push eax
inc esi
call fcn.00440099
add esp, 8
test eax, eax
jne 0x4111a4
cmp esi, 3
jl 0x411271
mov eax, dword [0x49671c]
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x444]
call fcn.00414100
add esp, 4
test eax, eax
je 0x411271
cmp dword [esp + 0xc], 0
jne 0x41126c
lea ebx, [esp + 0x440]
lea edi, [esp + 0x220]
call fcn.00411ab0
test eax, eax
je 0x411248
mov eax, edi
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x491a48
call fcn.0043b2e0
mov edx, ebx
mov ecx, edi
call fcn.00402be0
push eax
push str.nCompress_:__d
call fcn.00404c20
add esp, 8
mov esi, edi
call fcn.0043b0f0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x848]
xor ecx, esp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x18]
push edx
mov ecx, 0x491a48
call fcn.0043aef0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x848]
xor ecx, esp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret
call fcn.00414210
mov ecx, dword [esp + 0x854]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret
Function at 0x411290
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x20
push esi
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4112cd
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x4112d4
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x20
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0x10
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x20
ret
Function at 0x4116f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x48a4b0
push 0x441f50
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x48e050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x464], esi
push str.SoftwareBkav
push 0x47dd24
call fcn.00404c20
push 0x104
lea edi, [ebp - 0x460]
call fcn.00404ce0
add esp, 0xc
cmp eax, esi
jbe 0x411802
push str.BkavFirewallEngine.dll
mov eax, edi
push eax
mov ebx, 0x104
lea edi, [ebp - 0x240]
call fcn.0040def0
add esp, 8
test eax, eax
jle 0x411802
mov ecx, edi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411802
mov dword [ebp - 4], esi
mov edx, dword [ebp + 8]
push edx
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x468], edi
cmp edi, esi
je 0x4117ca
lea eax, [ebp - 0x240]
push eax
mov ecx, edi
call fcn.0040a0c0
add esp, 4
mov ebx, eax
mov dword [ebp - 0x464], ebx
cmp ebx, esi
jne 0x4117d2
xor ebx, ebx
mov dword [ebp - 0x464], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.004117f0
mov eax, ebx
jmp 0x411804
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret

Function at 0x411990
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [esp + 0x18]
push eax
push 0x2001f
push 0
push str.SYSTEMCurrentControlSetControlServiceGroupOrder
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411aa5
push 0x4000
mov dword [esp + 0x14], 0x4000
call fcn.0043e793
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
mov esi, eax
call fcn.0043e793
add esp, 4
lea edx, [esp + 0x10]
push edx
push esi
push 0
push 0
mov edi, eax
mov eax, dword [esp + 0x28]
push str.List
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
push esi
test ebx, ebx
jne 0x411a92
push str.pServiceGroups_:__s
call fcn.00404c20
push str.BkavSystemServiceGroup
push esi
call fcn.004403dc
add esp, 0x10
test eax, eax
je 0x411a2a
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push str.not_found
call fcn.00404c20
add esp, 4
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edi
mov edx, esi
mov dword [esp + 0x1c], 0
call fcn.00411820
add esp, 8
test eax, eax
jne 0x411a75
push esi
call fcn.0043e85d
add esp, 4
push edi
call fcn.0043e85d
mov eax, 5
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edx
push edi
push 7
push 0
push str.List
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
push esi
call fcn.0043e85d
add esp, 4
push edi
call fcn.0043e85d
mov eax, ebx
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x411ab0
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
sub esp, 0x2f8
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x2f0], eax
push esi
lea eax, [esp + 4]
push eax
push 1
push 0
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x411b02
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2f0]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x2f8
ret
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0xec]
push edx
push 0
push 0
push str.szTempDirectory
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x411aea
xor edx, edx
lea eax, [esp + 0xe8]
mov word [esp + 0x2ee], dx
lea edx, [eax + 2]
jmp 0x411b50
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411b50
sub eax, edx
sar eax, 1
je 0x411aea
push str.SafeRun
lea eax, [esp + 0xec]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x411aea
push str.SafeRun
push 0
lea ecx, [esp + 0xf0]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
mov esi, eax
test esi, esi
je 0x411aea
push esi
push str.pszIndex_:__s
call fcn.00404c20
lea eax, [esp + 0xf0]
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411bb3
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, esi
lea esi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x411bd0
sub eax, esi
sar eax, 1
sub ecx, eax
push ecx
lea edx, [esp + 0xec]
push edx
push 0x10e
push edi
call fcn.0043e9ba
add esp, 0x10
test eax, eax
jne 0x411aea
push edi
push str.lpBackupPath_:__s
call fcn.00404c20
add esp, 8
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x18]
movzx edx, word [esp + 0x16]
movzx eax, word [esp + 0x14]
push ecx
movzx ecx, word [esp + 0x10]
push edx
movzx edx, word [esp + 0x16]
push eax
movzx eax, word [esp + 0x1e]
push ecx
push edx
push eax
lea ecx, [esp + 0x38]
push str._d__d__d__d__d__d
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x10d
lea edx, [esp + 0x44]
push edx
push 0x10e
push ebx
call fcn.0043e9ba
add esp, 0x30
test eax, eax
jne 0x411aea
push ebx
push str.lpFileName:__s
call fcn.00404c20
push 0x10d
push 0x4576d8
push 0x10e
push edi
call fcn.0043e4d6
add esp, 0x18
test eax, eax
jne 0x411aea
push 0x10d
lea eax, [esp + 0x24]
push eax
push 0x10e
push edi
call fcn.0043e4d6
add esp, 0x10
test eax, eax
jne 0x411aea
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0x2f4]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0043e4c7
add esp, 0x2f8
ret
Function at 0x411ce0
Capabilities:
Delete file
Enumerate files on windows
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1ac4
call fcn.0044e2b0
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x1ac0], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0x814
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x411d3d
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1ac0]
xor ecx, esp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xa9c]
push edx
push 0
push 0
push str.szSafeRunBackup
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0xc]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x411d26
push 0x47df94
lea edx, [esp + 0xa9c]
push edx
lea eax, [esp + 0x12b8]
push 0x47903c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x12b4]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x411efa
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x5c]
push 0x47dcbc
push eax
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x411edb
lea ecx, [esp + 0x5c]
push 0x47dcc0
push ecx
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x411edb
test byte [esp + 0x30], 0x10
jne 0x411edb
lea edx, [esp + 0x5c]
push edx
push str.wfd.cFileName__s
call fcn.00404c20
add esp, 8
lea eax, [esp + 0x20]
push eax
call ebx
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
sbb ecx, dword [esp + 0x38]
push 0
push 0x989680
push ecx
push eax
call fcn.00449700
push 0
push 0xe10
push edx
push eax
call fcn.00449700
push 0
push 0x18
push edx
push eax
call fcn.00449700
mov esi, edx
mov edi, eax
push esi
push edi
push str.iDeltaDays_:_d
call fcn.00404c20
add esp, 0xc
test esi, esi
jl 0x411edb
jg 0x411e75
cmp edi, 0x1e
jb 0x411edb
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0xa9c]
push eax
lea ecx, [esp + 0x288]
push 0x47903c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0x290]
push edx
push str.szFilePath_:__s
call fcn.00404c20
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x18
lea eax, [esp + 0x280]
push eax
call esi
test eax, eax
jne 0x411edb
push 0x80
lea ecx, [esp + 0x284]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp + 0x280]
push edx
call esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x411db8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x1acc]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret
Function at 0x411f70
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x670
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x66c], eax
push esi
xor eax, eax
push 0x21a
push eax
lea ecx, [esp + 0x236]
push ecx
mov word [esp + 0x238], ax
call fcn.004416b0
add esp, 0xc
xor edx, edx
push 0x21a
push edx
lea eax, [esp + 0x456]
push eax
mov word [esp + 0x458], dx
call fcn.004416b0
add esp, 0xc
xor ecx, ecx
push 0x21a
push ecx
lea edx, [esp + 0x16]
push edx
mov word [esp + 0x18], cx
call fcn.004416b0
add esp, 0xc
push 0x104
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x412201
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x450]
push edx
lea eax, [esp + 0x10]
push eax
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x412201
call fcn.00407be0
test eax, eax
je 0x412056
push str.SysWOW64
push 0x104
lea ecx, [esp + 0x234]
push ecx
jmp 0x412068
push str._system32
push 0x104
lea edx, [esp + 0x234]
push edx
call fcn.0043f083
add esp, 0xc
call fcn.00405460
push str.BkavService.exe
test eax, eax
je 0x412143
lea eax, [esp + 0x450]
push eax
push 0x47903c
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0043ed50
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
lea edx, [esp + 0xc]
push edx
call esi
test eax, eax
je 0x4120e3
mov ecx, str.BkavService
call fcn.004082f0
test eax, eax
jne 0x4120e3
push 2
push 0x110
lea eax, [esp + 0x14]
push eax
push str.Bkav_service
push str.BkavServiceGroup
mov eax, str.BkavService
call fcn.00408240
add esp, 0x14
push str.EnterpriseUpdateService.exe
lea ecx, [esp + 0x450]
push ecx
push 0x47903c
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x14
lea eax, [esp + 0xc]
push eax
call esi
test eax, eax
je 0x412201
mov ecx, str.EnterpriseUpdateService
call fcn.004082f0
test eax, eax
jne 0x412201
push 2
push 0x110
lea ecx, [esp + 0x14]
push ecx
push str.Bkav_live_update_main_service
mov eax, str.EnterpriseUpdateService
jmp 0x4121f7
lea edx, [esp + 0x230]
push edx
push 0x47903c
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.0043ed50
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
call esi
test eax, eax
je 0x4121a4
mov ecx, str.BkavService
call fcn.004082f0
test eax, eax
jne 0x4121a4
push 2
push 0x110
lea edx, [esp + 0x14]
push edx
push str.Bkav_service
push str.BkavServiceGroup
mov eax, str.BkavService
call fcn.00408240
add esp, 0x14
push str.BluProService.exe
lea eax, [esp + 0x230]
push eax
push 0x47903c
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0043ed50
add esp, 0x14
lea edx, [esp + 0xc]
push edx
call esi
test eax, eax
je 0x412201
mov ecx, str.BluProService
call fcn.004082f0
test eax, eax
jne 0x412201
push 2
push 0x110
lea eax, [esp + 0x14]
push eax
push str.Bkav_Live_Update_service
mov eax, str.BluProService
push 0
call fcn.00408240
add esp, 0x14
mov ecx, dword [esp + 0x670]
pop esi
xor ecx, esp
call fcn.0043e4c7
add esp, 0x670
ret