Function at 0x417eb0
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1ef4
call fcn.0044e2b0
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x1ef0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
push 0x63f
xor edi, edi
lea ecx, [esp + 0x35]
push edi
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ebx
mov byte [esp + 0x3c], 0
call fcn.004416b0
xor eax, eax
add esp, 0xc
push 0x206
mov dword [esp + 0x109d], eax
mov dword [esp + 0x10a1], eax
mov dword [esp + 0x10a5], eax
mov word [esp + 0x10a9], ax
mov byte [esp + 0x10ab], al
mov byte [esp + 0x10ac], al
mov dword [esp + 0x10ad], eax
mov word [esp + 0x10b1], ax
mov byte [esp + 0x10b3], al
lea eax, [esp + 0x10c6]
xor edx, edx
push edi
push eax
mov byte [esp + 0x24], 0
mov byte [esp + 0x10a4], 0
mov word [esp + 0x10cc], dx
call fcn.004416b0
add esp, 0xc
push 0x206
lea edx, [esp + 0x14d6]
xor ecx, ecx
push edi
push edx
mov word [esp + 0x14dc], cx
call fcn.004416b0
add esp, 0xc
mov dword [esp + 0x10], 1
call fcn.00433bb0
mov dword [esp + 0x20], eax
mov eax, dword [0x496744]
cmp eax, edi
jne 0x417fc3
push 0x1404
call fcn.0043ef53
add esp, 4
cmp eax, edi
je 0x417fbc
mov esi, eax
call fcn.0041acd0
jmp 0x417fbe
xor eax, eax
mov dword [0x496744], eax
push 0x206
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x12ce]
xor eax, eax
push edi
push ecx
mov word [esp + 0x12d4], ax
call fcn.004416b0
add esp, 0xc
push 0x206
lea eax, [esp + 0x1cf6]
xor edx, edx
push edi
push eax
mov word [esp + 0x1cfc], dx
call fcn.004416b0
xor eax, eax
add esp, 0xc
mov byte [esp + 0x10b0], 0
mov dword [esp + 0x10b1], eax
mov dword [esp + 0x10b5], eax
mov dword [esp + 0x10b9], eax
mov word [esp + 0x10bd], ax
mov byte [esp + 0x10bf], al
call fcn.0041c9d0
push 0x206
lea edx, [esp + 0x18e6]
xor ecx, ecx
push edi
push edx
mov dword [esp + 0x28], edi
mov word [esp + 0x18ec], cx
call fcn.004416b0
mov eax, dword [ebx + 0xc]
add esp, 0xc
lea esi, [ebx + 0x14]
push esi
push eax
push str.IsBehaviourAllowedEx:_Event:__d__Path:__s
mov dword [ebx + 0x10], edi
call fcn.00404c20
add esp, 0xc
push 0x12c
push esi
call fcn.004066b0
push esi
push 0x479110
lea ecx, [esp + 0x10d0]
push 0x104
push ecx
call fcn.0043ed50
lea esi, [ebx + 0x26c]
add esp, 0x18
cmp word [esi], di
je 0x4180c2
push esi
push 0x479110
lea edx, [esp + 0x12d0]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x10
mov eax, dword [ebx + 0xc]
cmp eax, 0xfd
jne 0x418150
push 0x104
lea eax, [esp + 0x14d4]
push eax
push str._ALLUSERSPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 0x10c0]
push 0x5c
push ecx
call fcn.0044043d
mov esi, eax
add esp, 8
cmp esi, edi
je 0x418609
push str.BkavBkavHIPSBackup
lea edx, [esp + 0x14d4]
push 0x104
push edx
call fcn.0043f083
add esp, 0xc
push esi
lea eax, [esp + 0x14d4]
push 0x104
push eax
call fcn.0043f083
lea ecx, [esp + 0x10a4]
add esp, 0xc
push ecx
lea ecx, [esp + 0x14d4]
call fcn.0040a8d0
add esp, 4
jmp 0x418609
cmp eax, 0x7c
jne 0x418186
lea edx, [esp + 0x1098]
push edx
lea ecx, [esp + 0x10c4]
call fcn.0040a8d0
add esp, 4
lea eax, [esp + 0x12c8]
push 0x104
push eax
call fcn.004066b0
add esp, 8
jmp 0x418609
cmp eax, 0x7d
jne 0x4181c8
lea edx, [esp + 0x670]
lea ecx, [esp + 0x10c0]
call fcn.00414430
cmp eax, 1
jne 0x4181bc
lea ecx, [esp + 0x878]
push str.windows_powershell
push ecx
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x4181c4
mov dword [ebx + 0x10], edi
jmp 0x418b5c
mov dword [esp + 0x10], edi
cmp dword [ebx + 0xc], 0xc7
jne 0x4181e9
mov edx, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov esi, dword [esp + 0x20]
push edx
call fcn.004340f0
mov dword [ebx + 0x10], eax
jmp 0x418b5c
lea edi, [esp + 0x10c0]
call fcn.00407c40
test eax, eax
jne 0x4183a6
mov eax, dword [ebx + 4]
push eax
mov ecx, edi
call fcn.00406a00
mov eax, dword [ebx + 0xc]
add esp, 4
cmp eax, 0xc8
jne 0x41822e
push str.EVENT_BC_CHECK_PACK
call fcn.00404c20
add esp, 4
mov dword [ebx + 0x10], 0xffffffff
jmp 0x418b5c
cmp eax, 0x7f
jne 0x418287
mov ecx, dword [ebx + 4]
push ecx
call fcn.00406b40
add esp, 4
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18e4]
call fcn.004069b0
add esp, 4
lea ebx, [esp + 0x18e0]
lea edi, [esp + 0x10c0]
call fcn.00419030
cmp eax, 1
jne 0x41827b
mov edx, dword [esp + 0xc]
mov dword [edx + 0x10], 0
jmp 0x418b5c
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x10], 0
cmp dword [ebx + 0xc], 0x84
jne 0x4182c6
lea eax, [esp + 0x12c8]
push 0x104
push eax
call fcn.004066b0
mov ebx, dword [esp + 0x1c]
add esp, 8
lea ecx, [esp + 0x12c8]
push ecx
call fcn.004190c0
test eax, eax
je 0x41826b
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x10], 0
mov eax, dword [ebx + 0xc]
cmp eax, 0x14
je 0x4182d3
cmp eax, 0x73
jne 0x418312
lea eax, [esp + 0x12c8]
push 0x104
push eax
call fcn.004066b0
add esp, 8
mov ebx, esi
lea eax, [esp + 0x12c8]
call fcn.004196a0
test eax, eax
jne 0x418306
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x10], eax
jmp 0x418b5c
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x10], 0
cmp dword [ebx + 0xc], 0x70
jne 0x418335
mov edx, dword [ebx + 4]
push edx
lea edi, [esp + 0x10c4]
call fcn.00418f50
cmp eax, 1
je 0x4183a6
mov dword [esp + 0x10], 0
mov eax, dword [ebx + 0xc]
cmp eax, 0x2a
je 0x418346
call fcn.00417dd0
test eax, eax
je 0x41835e
lea eax, [esp + 0x10]
lea edi, [esp + 0x10c0]
call fcn.00417e30
test eax, eax
jne 0x418b5c
mov eax, dword [ebx + 0xc]
cmp eax, 1
je 0x41836f
call fcn.00417df0
test eax, eax
je 0x4183b2
push str.IsDangerousBehavior
call fcn.00404c20
lea eax, [esp + 0x10c4]
add esp, 4
push eax
call fcn.00406e10
add esp, 4
test eax, eax
je 0x4183f6
mov eax, dword [ebx + 0xc]
cmp eax, 0x7b
je 0x4183f6
cmp eax, 0x83
je 0x4183f6
cmp eax, 0xff
je 0x4183f6
mov dword [ebx + 0x10], 2
jmp 0x418b5c
cmp dword [esp + 0x10], 0
je 0x4183f6
lea ecx, [esp + 0x10c0]
call fcn.00407ef0
test eax, eax
jne 0x4185c6
lea esi, [esp + 0x10c0]
call fcn.00405540
test eax, eax
jne 0x4185c6
mov ecx, esi
push 1
push ecx
call fcn.004071e0
add esp, 8
test eax, eax
jne 0x4185c6
lea edx, [esp + 0x1098]
push edx
lea ecx, [esp + 0x10c4]
call fcn.0040a8d0
add esp, 4
test eax, eax
jne 0x41842f
lea eax, [esp + 0x10c0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41842f
mov dword [ebx + 0x10], 0
jmp 0x418b5c
mov eax, dword [ebx + 0xc]
mov cl, byte [ebx + 0xc]
mov byte [esp + 0x10a8], cl
cmp eax, 0x7b
je 0x41851c
cmp eax, 0x80
je 0x41851c
cmp eax, 0x82
je 0x41851c
cmp eax, 0x81
je 0x41851c
cmp eax, 0x83
je 0x41851c
cmp eax, 0x84
je 0x41851c
cmp eax, 0x7d
je 0x41851c
cmp eax, 0xff
je 0x41851c
cmp eax, 0x7f
jne 0x4184f5
mov ebx, dword [ebx + 4]
lea esi, [esp + 0x12c8]
call fcn.00409610
cmp eax, 1
jne 0x418605
lea eax, [esp + 0x10b0]
lea ecx, [esp + 0x1cf0]
mov edx, esi
call fcn.0040a3f0
test eax, eax
je 0x418605
mov eax, esi
mov esi, dword [esp + 0x14]
call fcn.00417210
movzx edx, al
mov byte [esp + 0x18], al
push edx
lea eax, [esp + 0x12cc]
push eax
push str._ws_Type:__d_r_n
call fcn.00404c20
mov ebx, dword [esp + 0x18]
jmp 0x418568
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x10c0]
call fcn.00417210
movzx ecx, al
push ecx
lea edx, [esp + 0x10c4]
push edx
mov byte [esp + 0x20], al
push str._ws_Type:__d_r_n
jmp 0x418563
lea eax, [esp + 0x10b0]
lea ecx, [esp + 0x1cf0]
lea edx, [esp + 0x12c8]
call fcn.0040a3f0
test eax, eax
je 0x418609
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x12c8]
call fcn.00417210
mov byte [esp + 0x18], al
movzx eax, al
push eax
lea ecx, [esp + 0x12cc]
push ecx
push str._ws__Type:__d_r_n
call fcn.00404c20
mov al, byte [esp + 0x24]
add esp, 0xc
cmp al, 1
jne 0x4185d8
mov eax, dword [ebx + 0xc]
cmp eax, 0x2a
je 0x418584
call fcn.00417dd0
test eax, eax
je 0x4185b9
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x10c4]
push eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00417240
mov ecx, eax
test ecx, ecx
je 0x418609
movzx eax, byte [ecx]
cmp eax, 0x2a
je 0x4185b9
call fcn.00417dd0
test eax, eax
je 0x4185d2
push str.IsBehaviourAllowedEx:__return_ALLOWED___reason:_BTL_TYPE_WHITE_r_n
call fcn.00404c20
add esp, 4
mov dword [ebx + 0x10], 2
jmp 0x418b5c
mov byte [ecx + 8], 0
jmp 0x418609
cmp al, 2
jne 0x4185f5
push str.IsBehaviourAllowedEx:__return_DENIED___reason:_BTL_TYPE_BLACK_r_n
call fcn.00404c20
add esp, 4
mov dword [ebx + 0x10], 3
jmp 0x418b5c
cmp al, 0x65
jne 0x418609
mov dword [ebx + 0x10], 2
jmp 0x418b5c
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0xc]
mov cl, byte [ebx + 0xc]
mov edx, dword [ebx + 4]
xor esi, esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x10], esi
mov byte [esp + 0x31], cl
mov dword [esp + 0x34], eax
mov byte [esp + 0x30], 0xa
mov dword [esp + 0x460], edx
cmp eax, 0x7b
je 0x4186a3
cmp eax, 0x80
je 0x4186a3
cmp eax, 0x82
je 0x4186a3
cmp eax, 0x81
je 0x4186a3
cmp eax, 0x83
je 0x4186a3
cmp eax, 0x84
je 0x4186a3
cmp eax, 0x7d
je 0x4186a3
cmp eax, 0x7f
je 0x4186a3
cmp eax, 0xff
je 0x4186a3
mov eax, dword [esp + 0x1098]
mov ecx, dword [esp + 0x109c]
mov edx, dword [esp + 0x10a0]
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x10a4]
mov dword [esp + 0x248], ecx
mov dword [esp + 0x24c], edx
mov dword [esp + 0x250], eax
jmp 0x4186db
mov ecx, dword [esp + 0x10b0]
mov edx, dword [esp + 0x10b4]
mov eax, dword [esp + 0x10b8]
mov dword [esp + 0x244], ecx
mov ecx, dword [esp + 0x10bc]
mov dword [esp + 0x248], edx
mov dword [esp + 0x24c], eax
mov dword [esp + 0x250], ecx
lea edx, [esp + 0x10c0]
push edx
lea eax, [esp + 0x3e]
push 0x104
push eax
call fcn.0043efc3
add esp, 0xc
cmp word [esp + 0x12c8], si
je 0x41871c
lea ecx, [esp + 0x12c8]
push ecx
lea edx, [esp + 0x468]
push 0x104
push edx
call fcn.0043efc3
add esp, 0xc
cmp dword [esp + 0x1c], esi
je 0x41873f
lea eax, [esp + 0x18e0]
push eax
lea ecx, [esp + 0x258]
push 0x104
push ecx
call fcn.0043efc3
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x2c]
push eax
push 0x640
lea eax, [esp + 0x3c]
push eax
push 1
call edx
mov eax, dword [esp + 0x2c]
push eax
push str.Co__d_Client_n
call fcn.00404c20
add esp, 8
cmp dword [esp + 0x2c], esi
jle 0x4187c5
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov edx, 1
test ecx, ecx
je 0x4187be
cmp dword [ecx + esi*4], 0
je 0x4187a0
mov eax, dword [ecx + esi*4]
cmp dword [eax + 8], edx
jne 0x4187a0
mov edi, dword [eax + 4]
mov dword [esp + 0x10], edx
jmp 0x4187b6
push str.SizeResult__0_n
call fcn.00404c20
mov ecx, dword [esp + 0x2c]
add esp, 4
mov edx, 1
add esi, edx
cmp esi, dword [esp + 0x2c]
jl 0x418785
cmp dword [esp + 0x10], 0
jne 0x418817
mov ecx, dword [esp + 0x24]
push 6
push ecx
mov ecx, str.BkavSystemServer.exe
call fcn.0041b8f0
mov eax, dword [ebx + 0xc]
cmp eax, 0x2a
je 0x4187ed
cmp eax, 0x17
je 0x4187ed
cmp eax, 0x3c
jb 0x4187f4
cmp eax, 0x47
ja 0x4187f4
mov dword [ebx + 0x10], 1
cmp eax, 0x7b
je 0x41880b
cmp eax, 0x83
je 0x41880b
cmp eax, 0x84
jne 0x418b42
mov dword [ebx + 0x10], 1
jmp 0x418b42
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x16e2]
push eax
mov word [esp + 0x16e4], dx
call fcn.004416b0
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1af2]
push edx
mov word [esp + 0x1af4], cx
call fcn.004416b0
add esp, 0xc
lea ebx, [esp + 0x16d8]
lea ecx, [esp + 0x10c0]
call fcn.0040a630
lea eax, [esp + 0x1ae8]
push eax
lea eax, [esp + 0x10c4]
call fcn.0040e750
movzx eax, byte [edi]
add esp, 4
cmp eax, 3
ja case.default.0x41888d
jmp dword [eax*4 + 0x418b78]
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x3a]
push ecx
push str.Tra_loi_cho_phep_BC__ws_vinh_vien_r_n
mov dword [ebx + 0x10], 2
call fcn.00404c20
add esp, 8
mov byte [esp + 0x18], 1
jmp 0x418929
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x3a]
push eax
push str.Tra_loi_chan_BC__ws_vinh_vien__r_n
mov dword [edx + 0x10], 3
call fcn.00404c20
mov ebx, dword [esp + 0x14]
add esp, 8
mov byte [esp + 0x18], 2
jmp 0x418929
mov ecx, dword [esp + 0xc]
push str.Tra_loi_cho_phep_r_n
mov dword [ecx + 0x10], 0
call fcn.00404c20
mov ebx, dword [esp + 0x10]
add esp, 4
jmp 0x418929
mov edx, dword [esp + 0xc]
push str.Tra_loi_chan_r_n
mov dword [edx + 0x10], 1
call fcn.00404c20
mov ebx, dword [esp + 0x10]
add esp, 4
jmp 0x418929
mov eax, dword [esp + 0xc]
mov dword [eax + 0x10], 0
mov ebx, eax
mov eax, dword [ebx + 0x10]
cmp eax, 2
je 0x41893a
mov edi, 2
test eax, eax
jne 0x41893f
mov edi, 1
mov dword [esp + 0x10], edi
call fcn.00402900
mov esi, eax
push 0x45778c
mov ecx, esi
call fcn.0043c580
push eax
push str.ConnectToServer_Report:__d
mov dword [esp + 0x14], eax
call fcn.00404c20
mov ecx, dword [ebx + 0xc]
push edi
push ecx
lea edx, [esp + 0x10d0]
push edx
push str.Report_Path:__s__Behavior:__d__Action:__d
call fcn.00404c20
mov eax, dword [ebx + 0xc]
add esp, 0x18
cmp eax, 0x7b
je 0x4189bf
cmp eax, 0x80
je 0x4189bf
cmp eax, 0x7f
je 0x4189bf
cmp eax, 0x82
je 0x4189bf
cmp eax, 0x81
je 0x4189bf
cmp eax, 0x83
je 0x4189bf
cmp eax, 0x84
je 0x4189bf
cmp eax, 0x7d
je 0x4189bf
cmp eax, 0xff
jne 0x418a59
cmp word [esp + 0x12c8], 0
je 0x418a59
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x10ac]
push ecx
lea edx, [esp + 0x10b8]
push edx
push edi
lea eax, [esp + 0x12d8]
call fcn.00417310
mov eax, dword [ebx + 0xc]
cmp eax, 0x7b
je 0x418a30
cmp eax, 0x7d
je 0x418a30
cmp eax, 0x80
je 0x418a29
cmp eax, 0x81
je 0x418a29
cmp eax, 0x7f
jne 0x418a19
lea ecx, [eax - 0x79]
jmp 0x418a35
xor ecx, ecx
cmp eax, 0x82
sete cl
lea ecx, [ecx + ecx + 0x11]
jmp 0x418a35
mov ecx, 0x10
jmp 0x418a35
mov ecx, 0xa
cmp dword [esp + 0xc], 0
je 0x418ace
lea edx, [esp + 0x16d8]
push edx
mov edx, dword [esp + 0x14]
push 5
push edx
push ecx
lea ebx, [esp + 0x12d8]
jmp 0x418aa8
cmp eax, 0xfd
je 0x418abc
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10ac]
push ecx
lea edx, [esp + 0x10a0]
push edx
push eax
lea eax, [esp + 0x10d0]
call fcn.00417310
cmp dword [esp + 0xc], 0
je 0x418aca
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x16d8]
push ecx
push 4
push edx
push 0x11
lea ebx, [esp + 0x10d0]
push 8
push eax
lea ecx, [esp + 0x1b00]
mov edi, str.Susp.Behavior
call fcn.00402980
cmp dword [esp + 0xc], 0
je 0x418aca
mov ecx, esi
call fcn.0043c710
mov edi, dword [esp + 0x14]
mov edx, dword [edi]
mov edx, dword [edx + 0x1c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push 4
lea eax, [esp + 0x30]
push eax
xor esi, esi
push 0x3a
mov ecx, edi
mov dword [esp + 0x38], 4
mov dword [esp + 0x30], esi
call edx
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, edi
call fcn.0043ca80
mov edx, dword [edi]
mov edx, dword [edx + 0x1c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push 4
lea eax, [esp + 0x30]
push eax
push 0x3a
mov ecx, edi
mov dword [esp + 0x38], 1
mov dword [esp + 0x30], esi
call edx
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, edi
call fcn.0043ca80
cmp dword [esp + 0x28], 0
je 0x418b5c
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.0043ca80
mov ecx, dword [esp + 0x1efc]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret 4