Function at 0x43cd60
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x13
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
cmp ebx, 4
stosb byte es:[edi], al
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
je 0x43cdae
cmp ebx, 3
je 0x43cdae
cmp ebx, 2
je 0x43cdae
cmp ebx, 1
je 0x43cdae
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0xf8]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0xfc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xf8]
push 0x5c
push ecx
call fcn.0045a180
add esp, 8
cmp eax, esi
je 0x43cdef
mov byte [eax + 1], 0
jmp 0x43ce0a
mov dx, word [0x472f84]
mov al, byte [0x472f86]
mov word [esp + 0xf8], dx
mov byte [esp + 0xfa], al
mov ecx, 0xb
mov esi, str.SystemCurrentControlSetServicesVxDKaseya
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x84]
push edx
push 0x80000002
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, eax
xor eax, eax
test edx, edx
mov ecx, 0x41
lea edi, [esp + 0x200]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [esp + 0x10], 0x105
jne 0x43d048
xor eax, eax
sub ebx, 2
je 0x43cf90
dec ebx
je 0x43cf45
dec ebx
je 0x43cee1
mov cl, byte [eax + 0x486fd8]
mov byte [esp + eax + 0x78], cl
inc eax
test cl, cl
jne 0x43ce72
push str.KasError.log
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x310]
push 0x4697b0
push ecx
call fcn.00458ee7
mov edx, dword [str.KaseyaErrorLogSema]
mov eax, dword [0x46bbd4]
mov ecx, dword [0x46bbd8]
mov dword [esp + 0x28], edx
mov edx, dword [0x46bbdc]
mov dword [esp + 0x2c], eax
mov ax, word [0x46bbe0]
mov dword [esp + 0x30], ecx
mov cl, byte [0x46bbe2]
mov dword [esp + 0x34], edx
mov word [esp + 0x38], ax
mov byte [esp + 0x3a], cl
jmp 0x43cfd1
mov cl, byte [eax + 0x487008]
mov byte [esp + eax + 0x78], cl
inc eax
test cl, cl
jne 0x43cee1
push str.KasAgent.log
lea edx, [esp + 0xfc]
push edx
lea eax, [esp + 0x310]
push 0x4697b0
push eax
call fcn.00458ee7
mov ecx, dword [str.KaseyaConfigLogSema]
mov edx, dword [0x46bbe8]
mov eax, dword [0x46bbec]
mov dword [esp + 0x28], ecx
mov ecx, dword [0x46bbf0]
mov dword [esp + 0x2c], edx
mov edx, dword [0x46bbf4]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
jmp 0x43cfd1
mov cl, byte [eax + 0x486ff8]
mov byte [esp + eax + 0x78], cl
inc eax
test cl, cl
jne 0x43cf45
push str.KasFirewall.log
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x310]
push 0x4697b0
push ecx
call fcn.00458ee7
mov ecx, 7
mov esi, str.KaseyaFirewallLogByPeriodSema
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x43cfd1
mov cl, byte [eax + 0x486fe8]
mov byte [esp + eax + 0x78], cl
inc eax
test cl, cl
jne 0x43cf90
push str.KasStats.log
lea edx, [esp + 0xfc]
push edx
lea eax, [esp + 0x310]
push 0x4697b0
push eax
call fcn.00458ee7
mov ecx, 7
mov esi, str.KaseyaStatisticLogByPeriodSema
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x204]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esp + 0x88]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43d028
lea eax, [esp + 0x200]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d016
sub eax, edx
cmp eax, 1
jae 0x43d174
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x308]
mov byte [esp + eax + 0x200], cl
inc eax
test cl, cl
jne 0x43d030
jmp 0x43d174
sub ebx, 2
je 0x43d13f
dec ebx
je 0x43d10c
dec ebx
je 0x43d0bb
push str.KasError.log
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0x208]
push 0x4697b0
push edx
call fcn.00458ee7
mov eax, dword [str.KaseyaErrorLogSema]
mov ecx, dword [0x46bbd4]
mov edx, dword [0x46bbd8]
mov dword [esp + 0x28], eax
mov eax, dword [0x46bbdc]
mov dword [esp + 0x2c], ecx
mov cx, word [0x46bbe0]
mov dword [esp + 0x30], edx
mov dl, byte [0x46bbe2]
mov dword [esp + 0x34], eax
mov word [esp + 0x38], cx
mov byte [esp + 0x3a], dl
jmp 0x43d171
push str.KasAgent.log
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x208]
push 0x4697b0
push ecx
call fcn.00458ee7
mov edx, dword [str.KaseyaConfigLogSema]
mov eax, dword [0x46bbe8]
mov ecx, dword [0x46bbec]
mov dword [esp + 0x28], edx
mov edx, dword [0x46bbf0]
mov dword [esp + 0x2c], eax
mov eax, dword [0x46bbf4]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
jmp 0x43d171
push str.KasFirewall.log
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0x208]
push 0x4697b0
push edx
call fcn.00458ee7
mov ecx, 7
mov esi, str.KaseyaFirewallLogByPeriodSema
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x43d171
push str.KasStats.log
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x208]
push 0x4697b0
push ecx
call fcn.00458ee7
mov ecx, 7
mov esi, str.KaseyaStatisticLogByPeriodSema
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
add esp, 0x10
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x78], 0xc
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x43d1bd
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43d1bd
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
lea ecx, [esp + 0x200]
push 0x4698e4
push ecx
call fcn.00459902
mov esi, eax
add esp, 8
test esi, esi
je 0x43d1f5
push 2
push 0
push esi
call fcn.0045985d
push esi
call fcn.0045978d
push esi
mov ebx, eax
call fcn.00459521
add esp, 0x14
jmp 0x43d1f7
xor ebx, ebx
cmp ebx, dword [ebp + 0xc]
jle 0x43d21e
lea edx, [esp + 0x200]
push 0x469850
push edx
call fcn.00459902
add esp, 8
test eax, eax
je 0x43d21e
push eax
call fcn.00459521
add esp, 4
test edi, edi
je 0x43d230
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret