joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d050
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2f0
mov eax, dword [0x4b6640]
xor eax, esp
mov dword [esp + 0x2ec], eax
mov eax, dword [esp + 0x2fc]
push ebx
mov ebx, dword [esp + 0x304]
push ebp
mov ebp, dword [esp + 0x30c]
push esi
mov esi, dword [esp + 0x304]
push edi
mov edi, dword [esp + 0x304]
push 0x64
lea ecx, [esp + 0x30]
push 0
push ecx
mov dword [esp + 0x30], eax
call fcn.00462ef0
mov edx, ebx
shr edx, 8
movzx eax, dl
movzx ecx, bl
shl ecx, 8
or eax, ecx
shl eax, 8
mov edx, ebx
shr edx, 0x10
movzx ecx, dl
or eax, ecx
shl eax, 8
shr ebx, 0x18
or eax, ebx
push eax
mov eax, dword [esp + 0x34]
xor ecx, ecx
mov edx, eax
shr edx, 0x10
mov ch, dl
mov edx, eax
shr edx, 0x18
mov cl, dl
push ecx
mov ecx, eax
shr ecx, 8
movzx eax, al
movzx edx, cl
shl eax, 8
or edx, eax
push edx
mov ecx, esi
movzx edx, si
mov esi, dword [0x49f380]
shr ecx, 0x10
push ecx
push edx
push edi
push str._X__X__X__X__X_X
lea eax, [esp + 0x54]
push 0x63
push eax
call esi
lea ecx, [esp + 0x5c]
push ecx
push str.CLSID_sLocalServer32
lea edx, [esp + 0x12c]
push 0x103
push edx
call esi
add esp, 0x40
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xf8]
push ecx
push 0x80000000
call dword [0x49f014]
test eax, eax
jne 0x42d179
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push ebp
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], 0x104
call dword [0x49f018]
test eax, eax
je 0x42d17d
mov edx, dword [esp + 0x10]
push edx
call dword [0x49f030]
xor al, al
jmp 0x42d18a
mov eax, dword [esp + 0x10]
push eax
call dword [0x49f030]
mov al, 1
mov ecx, dword [esp + 0x2fc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004629a0
add esp, 0x2f0
ret
Function at 0x433c20
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esi + 8]
push eax
push 0x4337c0
push 0
push 0
mov byte [esi + 0x18], 0
mov dword [eax], esi
mov dword [esi + 0xc], ecx
call fcn.004648d4
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x433c5c
mov dword [esi + 4], 0
cmp dword [esi + 4], 0
jne 0x433c6d
mov byte [esi + 0x18], 1
xor al, al
pop esi
pop ecx
ret 4
mov al, 1
pop esi
pop ecx
ret 4

Function at 0x434990
Capabilities:
Get file version info

Disassembly:
sub esp, 0x34
push ebx
push esi
push edi
mov esi, ecx
push 0
lea ebx, [esi + 0x30]
push ebx
call fcn.00493852
mov edi, eax
test edi, edi
jne 0x4349b2
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x34
ret
push edi
call fcn.00462f90
push edi
push 0
push eax
mov dword [esi + 8], eax
call fcn.00462ef0
mov eax, dword [esi + 8]
add esp, 0x10
push eax
push edi
push 0
push ebx
call fcn.0049384c
test eax, eax
je 0x4349a9
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00434670
test eax, eax
je 0x4349a9
mov eax, dword [esp + 0x14]
mov edx, eax
mov word [esi + 0xe], ax
mov eax, dword [esp + 0x18]
shr edx, 0x10
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x1c]
shr ecx, 0x10
mov word [esi + 0xc], dx
mov edx, eax
mov word [esi + 0x10], cx
mov word [esi + 0x16], ax
mov eax, dword [esp + 0x20]
mov ecx, eax
shr ecx, 0x10
mov word [esi + 0x18], cx
mov ecx, dword [esp + 0x2c]
shr edx, 0x10
mov word [esi + 0x14], dx
mov edx, dword [esp + 0x24]
mov word [esi + 0x1a], ax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x24], ecx
push 0x104
lea ecx, [esi + 0x238]
push ecx
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x3c]
push 0x4a1bb4
mov ecx, esi
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
call fcn.004347b0
test eax, eax
je 0x4349a9
push 0x104
lea edx, [esi + 0x648]
push edx
push 0x4a1b94
mov ecx, esi
call fcn.004347b0
test eax, eax
je 0x4349a9
push 0x104
lea eax, [esi + 0x440]
push eax
push 0x4a1b7c
mov ecx, esi
call fcn.004347b0
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
add esp, 0x34
ret

Function at 0x434b90
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
push 0x4a1bdc
push 1
push 0
push 0x4a1bcc
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [edi], 0
call dword [0x49f54c]
mov esi, eax
test esi, esi
jl 0x434bf4
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov esi, eax
test esi, esi
jl 0x434bf4
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x434c04
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x434c14
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x4377c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x498b98
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4b6640]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push esi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00443ce0
xor ebx, ebx
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], ebx
call fcn.00444740
test al, al
jne 0x43784c
push ebx
call dword [0x49f550]
lea eax, [esp + 0x10]
push eax
call dword [0x49f538]
test eax, eax
jne 0x437844
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov bl, 1
call dword [0x49f554]
jmp 0x43784e
mov bl, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00443cf0
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004629a0
add esp, 0x24
ret

Function at 0x4382c0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x4b6640]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [0x49f008]
cmp eax, ebx
mov dword [esp + 4], eax
je 0x43833b
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [0x49f00c]
test eax, eax
jne 0x43832a
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [0x49f010]
mov eax, dword [esp + 4]
cmp eax, ebx
mov ecx, dword [esp + 0x14]
setne al
pop ebx
xor ecx, esp
call fcn.004629a0
add esp, 0x14
ret
Function at 0x439070
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x498d03
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x4b6640]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov esi, dword [esp + 0x270]
mov ebp, dword [esp + 0x274]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov dword [esp + 0x50], esi
mov word [esi + 4], bx
push 0x208
lea eax, [esp + 0x58]
push ebx
mov edi, 1
push eax
mov dword [esp + 0x274], ebx
mov dword [esp + 0x20], edi
call fcn.00462ef0
add esp, 0xc
push edi
push 0x2b
lea ecx, [esp + 0x5c]
push ecx
push ebx
call dword [0x49f370]
test eax, eax
je 0x439217
lea eax, [esp + 0x54]
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x439123
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x58]
push edx
lea ecx, [esp + 0x3c]
call fcn.00409a40
push str.TencentQQDownload
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x274], edi
call fcn.0040a130
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x274], 2
call fcn.00409840
mov edi, 8
cmp dword [esp + 0x30], edi
jb 0x43918a
mov edx, dword [esp + 0x1c]
push edx
call fcn.004629d9
add esp, 4
cmp dword [esp + 0x4c], edi
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
mov byte [esp + 0x268], bl
jb 0x4391b5
mov eax, dword [esp + 0x38]
push eax
call fcn.004629d9
add esp, 4
cmp dword [ebp + 0x14], ebx
je 0x4391fd
push ebp
lea ecx, [esp + 0x1c]
push 0x4a05a4
push ecx
call fcn.004387f0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov dword [esp + 0x274], 3
call fcn.00409840
cmp dword [esp + 0x30], edi
mov byte [esp + 0x268], bl
jb 0x4391fd
mov edx, dword [esp + 0x1c]
push edx
call fcn.004629d9
add esp, 4
push esi
call fcn.00438a50
add esp, 4
test al, al
jne 0x439224
push esi
call fcn.00438bb0
add esp, 4
cmp al, bl
jne 0x439224
push ebx
push 0x4a15f0
mov ecx, esi
call fcn.00409a40
mov eax, esi
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.004629a0
add esp, 0x258
ret
Function at 0x439250
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x498d61
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x4b6640]
xor eax, esp
mov dword [esp + 0x46c], eax
push ebx
push esi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x47c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x48c]
xor ebx, ebx
test byte [0x4b8c98], 1
mov dword [esp + 0xc], ebx
jne 0x4392ca
or dword [0x4b8c98], 1
push 0x49e290
mov dword [0x4b8c94], 7
mov dword [0x4b8c90], ebx
mov word [0x4b8c80], bx
call fcn.004636d8
add esp, 4
cmp dword [0x4b8c90], ebx
jne 0x43944c
push 0x208
lea eax, [esp + 0x274]
push ebx
push eax
call fcn.00462ef0
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x278]
push ecx
push ebx
call dword [0x49f370]
test eax, eax
je 0x4393b6
lea edx, [esp + 0x270]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040a0f0
push str.TencentTencentdl
push eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x490], ebx
call fcn.0040a130
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x4b8c7c
mov byte [esp + 0x490], 1
call fcn.00409840
cmp dword [esp + 0x44], 8
jb 0x43935c
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004629d9
add esp, 4
cmp dword [esp + 0x60], 8
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
mov dword [esp + 0x484], 0xffffffff
jb 0x43938c
mov edx, dword [esp + 0x4c]
push edx
call fcn.004629d9
add esp, 4
push 0x4b8c7c
call fcn.00438a50
add esp, 4
test al, al
jne 0x43944c
push 0x4b8c7c
call fcn.00438bb0
add esp, 4
cmp al, bl
jne 0x43944c
push 0x208
lea eax, [esp + 0x6a]
push ebx
push eax
mov word [esp + 0x70], bx
call fcn.00462ef0
add esp, 0xc
push 0x20a
lea ecx, [esp + 0x68]
push ecx
push ebx
call dword [0x49f2dc]
lea edx, [esp + 0x64]
push 0x5c
push edx
call fcn.004652e2
add esp, 8
cmp eax, ebx
je 0x4393f5
mov word [eax], bx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x14]
call fcn.0040a0f0
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x4b8c7c
mov dword [esp + 0x490], 2
call fcn.00409950
cmp dword [esp + 0x28], 8
mov dword [esp + 0x484], 0xffffffff
jb 0x43943b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004629d9
add esp, 4
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], bx
push 0xffffffffffffffff
push ebx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0x4b8c7c
mov ecx, esi
mov word [esi + 4], bx
call fcn.00409950
mov eax, esi
mov ecx, dword [esp + 0x47c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x46c]
xor ecx, esp
call fcn.004629a0
add esp, 0x47c
ret
Function at 0x4394a0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x498ddb
mov eax, dword fs:[0]
push eax
sub esp, 0x458
mov eax, dword [0x4b6640]
xor eax, esp
mov dword [esp + 0x454], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x46c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x47c]
xor ebx, ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov ebp, 7
mov edi, 1
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
mov dword [esp + 0x474], edi
mov word [esi + 4], bx
push 0x208
lea eax, [esp + 0x264]
push ebx
push eax
mov dword [esp + 0x3c], edi
call fcn.00462ef0
mov cl, byte [esp + 0x4ac]
add esp, 0xc
neg cl
push edi
lea edx, [esp + 0x264]
sbb ecx, ecx
and ecx, 0xfffffff7
add ecx, 0x23
push ecx
push edx
push ebx
call dword [0x49f370]
test eax, eax
lea edi, [ebx + 8]
je 0x439618
lea eax, [esp + 0x260]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x439565
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0x1c]
call fcn.00409a40
lea ecx, [esp + 0x484]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x480], 2
call fcn.00413890
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x480], 3
call fcn.00409840
cmp dword [esp + 0x50], edi
jb 0x4395ce
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.004629d9
add esp, 4
cmp dword [esp + 0x2c], edi
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
mov byte [esp + 0x474], 1
jb 0x4395f6
mov edx, dword [esp + 0x18]
push edx
call fcn.004629d9
add esp, 4
push esi
call fcn.00438a50
add esp, 4
test al, al
jne 0x4396b8
push esi
call fcn.00438bb0
add esp, 4
cmp al, bl
jne 0x4396b8
push 0x208
lea eax, [esp + 0x5a]
push ebx
push eax
mov word [esp + 0x60], bx
call fcn.00462ef0
add esp, 0xc
push 0x20a
lea ecx, [esp + 0x58]
push ecx
push ebx
call dword [0x49f2dc]
lea edx, [esp + 0x54]
push 0x5c
push edx
call fcn.004652e2
add esp, 8
cmp eax, ebx
je 0x439657
mov word [eax], bx
lea eax, [esp + 0x54]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea edx, [eax + 2]
jmp 0x439670
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x439670
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x1c]
call fcn.00409a40
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov byte [esp + 0x480], 4
call fcn.00409950
cmp dword [esp + 0x2c], edi
jb 0x4396b8
mov edx, dword [esp + 0x18]
push edx
call fcn.004629d9
add esp, 4
cmp dword [esp + 0x49c], edi
jb 0x4396d1
mov eax, dword [esp + 0x488]
push eax
call fcn.004629d9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x46c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x454]
xor ecx, esp
call fcn.004629a0
add esp, 0x464
ret
Function at 0x439f70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x498f3e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x4a1d64
push fcn.00408b90
push 3
push 4
lea eax, [esi + 0x34]
push eax
mov dword [esp + 0x28], 2
call fcn.004631ae
mov eax, dword [esi + 0x30]
mov edi, dword [0x49f31c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4b5100]
mov byte [esp + 0x18], 1
je 0x439feb
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x439feb
mov eax, dword [esi + 0x30]
sub eax, 0xc
push eax
call fcn.00462c8a
add esp, 4
mov eax, dword [esi + 0x2c]
lea edx, [eax - 0xc]
cmp edx, dword [0x4b5100]
mov byte [esp + 0x18], 0
je 0x43a017
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x43a017
mov eax, dword [esi + 0x2c]
sub eax, 0xc
push eax
call fcn.00462c8a
add esp, 4
mov esi, dword [esi + 0x14]
test esi, esi
mov dword [esp + 0x18], 0xffffffff
je 0x43a02c
push esi
call fcn.0049105a
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x43a640
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x498f3e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [0x49f41c]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi], 0x4a1d64
mov dword [esi + 0x24], ebx
mov ecx, dword [0x4b5104]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ecx
mov edx, dword [0x4b5104]
mov dword [esi + 0x30], edx
push fcn.00408b90
push 0x408d30
push 3
push 4
lea eax, [esi + 0x34]
push eax
mov byte [esp + 0x2c], 2
call fcn.00463fec
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov byte [esi + 0x94], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x43b530
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [0x4b6640]
xor eax, esp
mov dword [esp + 0x118], eax
push ebp
push esi
mov esi, dword [esp + 0x128]
push edi
mov edi, dword [section..rdata]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov ebp, 3
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call edi
test eax, eax
jne 0x43b6c4
push esi
push str._sConnection
lea ecx, [esp + 0x28]
push 0x103
push ecx
call fcn.0043b510
mov ecx, dword [esp + 0x2c]
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
lea eax, [esp + 0x2c]
push eax
push ecx
call edi
test eax, eax
mov edi, dword [0x49f030]
jne 0x43b6bd
mov esi, dword [0x49f004]
mov eax, 4
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.MediaSubType
push edx
call esi
test eax, eax
jne 0x43b6b6
push 0x104
push eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x103
call fcn.00462ef0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.PnpInstanceID
push ecx
call esi
test eax, eax
jne 0x43b6b6
mov esi, 1
cmp dword [esp + 0xc], esi
jne 0x43b6a6
push ebp
lea edx, [esp + 0x24]
push 0x4a1e08
push edx
call fcn.00465e62
add esp, 0xc
test eax, eax
jne 0x43b681
xor ebp, ebp
jmp 0x43b6b6
cmp dword [esp + 0xc], esi
jne 0x43b6a6
push 3
lea eax, [esp + 0x24]
push 0x4a1e08
push eax
call fcn.00465e62
add esp, 0xc
test eax, eax
je 0x43b6a6
mov ebp, 2
jmp 0x43b6b6
xor ecx, ecx
cmp dword [esp + 0xc], 2
setne cl
lea ecx, [ecx + ecx + 1]
mov ebp, ecx
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0x1c]
push eax
call edi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.004629a0
add esp, 0x11c
ret
Function at 0x43c230
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x4b6640]
xor eax, esp
mov dword [esp + 0x14], eax
mov ax, word [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push esi
push 0x11
push 2
push 2
mov word [esp + 0x14], 2
mov word [esp + 0x16], ax
mov dword [esp + 0x18], ecx
call dword [0x49f504]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 4], 0x10000
je 0x43c2a3
push edi
mov edi, dword [0x49f50c]
push 4
lea edx, [esp + 0xc]
push edx
push 0x1002
push 0xffff
push esi
call edi
push 4
lea eax, [esp + 0xc]
push eax
push 0x1001
push 0xffff
push esi
call edi
pop edi
cmp byte [esp + 0x28], 0
je 0x43c2e7
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [0x49f4f8]
cmp eax, 0xffffffff
jne 0x43c2e7
cmp esi, 0xffffffff
je 0x43c2d4
push esi
call dword [0x49f4c0]
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004629a0
add esp, 0x18
ret
push 0x10
lea edx, [esp + 0xc]
push edx
push esi
call dword [0x49f4fc]
cmp eax, 0xffffffff
je 0x43c2c8
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004629a0
add esp, 0x18
ret

Function at 0x43dba0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49911e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
lea ebp, [esi + 4]
mov dword [esi], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
lea edi, [esi + 0x14]
mov dword [esp + 0x30], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esp + 0x14]
push eax
push 0x4b63b8
push 0x4b6380
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 1
call fcn.0040bf20
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x34], 2
call fcn.0040bcc0
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov byte [esp + 0x30], 1
je 0x43dc31
push eax
call fcn.004629d9
add esp, 4
push edi
mov ecx, ebp
call fcn.0040bcc0
mov edx, dword [str.www.tencent.com.]
mov dword [esi + 0x24], edx
mov eax, dword [0x4a1f38]
mov dword [esi + 0x28], eax
mov ecx, dword [0x4a1f3c]
mov dword [esi + 0x2c], ecx
mov edx, dword [0x4a1f40]
mov dword [esi + 0x30], edx
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x2c]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], eax
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x43ea50
Capabilities:
Access peb ldr_data
Get ntdll base address
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x499204
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4b6640]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x24]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x28]
mov dword [esi], 0x4a1f48
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0x65
mov dword [esi + 0x18], 0x12dd668
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], 0x34
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov edx, 1
mov dword [esi + 0x20], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esp + 0x1c], eax
mov dword [esi + 0x4018], eax
mov dword [esi + 0x401c], eax
mov dword [esi + 0x4020], eax
mov dword [esi + 0x4028], eax
mov dword [esi + 0x402c], eax
mov dword [esi + 0x4030], eax
cmp ecx, 0xffffffff
mov eax, 2
mov byte [esp + 0x1c], al
je 0x43eb6a
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0xc]
push 0x8004667e
push edx
mov dword [esi + 0x10], eax
call dword [0x49f4f8]
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
mov dword [esp + 0x24], 0x10000
je 0x43eb5d
mov ebx, dword [0x49f50c]
push 4
lea eax, [esp + 0x28]
push eax
push 0x1002
push 0xffff
push edi
call ebx
push 4
lea ecx, [esp + 0x28]
push ecx
push 0x1001
push 0xffff
push edi
call ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push esi
push edx
call fcn.0043e070
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8