joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439ab0
Capabilities:
Set registry value

Disassembly:
push ebp
push esi
mov esi, dword [ecx + 4]
xor ebp, ebp
test esi, esi
je 0x439b03
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x439b0a
mov edx, dword [esp + 0x14]
test edx, edx
je 0x439b0a
mov eax, edx
push edi
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x439ad2
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop edi
jne 0x439b0a
pop ebx
pop esi
mov eax, 1
pop ebp
ret 8
pop esi
mov eax, ebp
pop ebp
ret 8
pop ebx
pop esi
mov eax, ebp
pop ebp
ret 8

Function at 0x439b20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push esi
xor esi, esi
test eax, eax
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
je 0x439c2e
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x439c2e
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push edi
lea edx, [esp + 0x24]
push edx
push ebx
lea edx, [esp + 0x28]
push edx
push esi
push ecx
lea edi, [ebp + ebp]
push eax
mov dword [esp + 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x20], 1
jne 0x439c37
test eax, eax
jne 0x439b8d
mov word [edi + ebx - 2], si
pop edi
pop ebp
pop ebx
lea eax, [esi + 1]
pop esi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x24]
add eax, 2
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x439c20
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push esi
lea edx, [esp + 0x28]
push edx
mov edx, dword [ecx + 4]
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x439c06
mov eax, dword [esp + 0x24]
lea ecx, [ebp - 1]
push ecx
push esi
shr eax, 1
push ebp
push ebx
mov word [esi + eax*2], 0
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
mov word [edi + ebx - 2], 0
push esi
mov edi, 1
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret 0xc
mov edi, dword [esp + 0x10]
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret 0xc
mov eax, esi
pop esi
add esp, 8
ret 0xc
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 8
ret 0xc
Function at 0x439e20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [ecx]
push ebx
push ebp
xor edx, edx
cmp eax, edx
push esi
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
je 0x439f01
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x28]
push ecx
push edx
push ebx
push eax
call ebp
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x439e6b
cmp eax, 2
jne 0x439f01
mov edi, dword [esp + 0x24]
mov ecx, edi
call fcn.00404810
mov ecx, dword [edi]
mov eax, dword [esp + 0x10]
sub ecx, 0x10
shr eax, 1
mov edx, 1
sub edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
add eax, 1
sub ecx, eax
or edx, ecx
jge 0x439e9d
push eax
mov ecx, edi
call fcn.00404a00
mov esi, dword [edi]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
mov edx, dword [ecx]
push esi
lea eax, [esp + 0x28]
push eax
push 0
push ebx
push edx
call ebp
test eax, eax
jne 0x439ece
mov eax, dword [esp + 0x10]
shr eax, 1
mov word [esi + eax*2], 0
mov dword [esp + 0x14], 1
mov edx, dword [edi]
test edx, edx
jne 0x439ed8
xor eax, eax
jmp 0x439ef1
mov eax, edx
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x439ee0
sub eax, esi
sar eax, 1
js 0x439f0f
cmp eax, dword [edx - 8]
jg 0x439f0f
mov dword [edx - 0xc], eax
mov ecx, dword [edi]
mov word [ecx + eax*2], 0
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
push 0x80070057
call fcn.004011d0
int3

Function at 0x43a3b0
Capabilities:
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4abc38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
push esi
lea ecx, [esp + 0x18]
call fcn.004079b0
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebp, 0xffffffff
cmp eax, ebp
je 0x43a411
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x20], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
jmp 0x43a497
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x43a484
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x43a484
lea ecx, [esp + 0x14]
push ecx
call fcn.00439f50
mov eax, dword [esp + 0x18]
add esp, 4
cmp dword [eax - 0xc], 0
jne 0x43a465
lea ecx, [esp + 0x14]
call fcn.00404930
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push eax
call fcn.0043a3b0
add esp, 4
test eax, eax
je 0x43a446
push 0
push esi
call edi
test eax, eax
jne 0x43a484
call ebx
cmp eax, 0xb7
jne 0x43a446
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x20], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x43a4a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x43a4c0
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
lea eax, [esp + 0x18]
push eax
push ebx
mov esi, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x43a51c
push edi
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
push edi
push 0
push eax
mov dword [esi], eax
call sub.MSVCR80.dll_memset
mov ecx, dword [esi]
mov edx, dword [esp + 0x28]
add esp, 0x10
push ecx
push edi
push edx
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
mov eax, dword [esi]
jne 0x43a527
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x4b89d0
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x43a545
mov ecx, dword [esi]
push ecx
jmp 0x43a507
mov eax, dword [esp + 0xc]
movzx edx, word [eax]
movzx eax, word [eax + 2]
shl edx, 0x10
or edx, eax
pop edi
mov dword [esi + 4], edx
pop esi
mov eax, 1
pop ebx
add esp, 8
ret 4

Function at 0x43a9c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
lea edx, [esp + 0xc]
xor edi, edi
push edx
mov dword [eax], edi
push ebp
mov dword [esp + 0x14], edi
mov dword [ecx], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x43aa63
push ebx
push esi
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x10]
push ebx
push esi
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43aa4c
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x4b43f8
xor esi, esi
push ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43aa4c
cmp dword [esp + 0x14], esi
je 0x43aa4c
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x24]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
lea edi, [esi + 1]
test ebx, ebx
je 0x43aa59
push ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x43ab70
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4abd22
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov esi, dword [esp + 0x230]
xor edi, edi
mov dword [esp + 0xc], edi
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
mov dword [esp + 0x228], edi
mov dword [esp + 0x10], esi
call edx
add eax, 0x10
mov dword [esi], eax
push 0x206
lea eax, [esp + 0x1a]
push edi
push eax
mov dword [esp + 0x234], edi
mov dword [esp + 0x18], 1
mov word [esp + 0x20], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43ac13
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.00405620
push esi
call fcn.0043aa70
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0048e5b2
add esp, 0x220
ret

Function at 0x43ade0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
push 0x11c
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call edi
test eax, eax
jne 0x43ae3b
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call edi
test eax, eax
je 0x43aefa
mov eax, dword [esp + 0x18]
mov edx, 1
sub eax, edx
je 0x43aee5
sub eax, edx
je 0x43ae57
xor esi, esi
jmp 0x43aefa
mov eax, dword [esp + 0xc]
cmp eax, 6
mov ecx, dword [esp + 0x10]
jne 0x43ae91
cmp ecx, edx
jne 0x43ae7b
xor eax, eax
cmp byte [esp + 0x122], dl
setne al
add eax, 8
mov esi, eax
jmp 0x43aefa
test ecx, ecx
jne 0x43aec9
cmp byte [esp + 0x122], dl
setne cl
lea ecx, [ecx + ecx + 7]
mov esi, ecx
jmp 0x43aefa
cmp eax, 5
jne 0x43aeb8
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x43aea4
lea esi, [eax + 3]
jmp 0x43aefa
cmp eax, edx
jne 0x43aeaf
mov esi, 6
jmp 0x43aefa
test eax, eax
jne 0x43aefa
lea esi, [eax + 3]
jmp 0x43aefa
cmp eax, 4
ja 0x43aec4
mov esi, 4
jmp 0x43aefa
cmp eax, 6
jb 0x43aefa
cmp ecx, 2
jae 0x43aed3
cmp eax, 6
jbe 0x43aefa
cmp byte [esp + 0x122], dl
jne 0x43aefa
call fcn.0043ac60
mov esi, eax
jmp 0x43aefa
mov edx, dword [esp + 0x14]
and edx, 0xffff0000
cmp edx, 0x45a0000
sbb esi, esi
add esi, 2
mov ecx, dword [esp + 0x124]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0048e5b2
add esp, 0x120
ret
Function at 0x43b310
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov ecx, ebp
mov dword [esp + 0x14], edi
call fcn.00402f70
mov eax, dword [esp + 0x1c]
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x20], esi
je 0x43b408
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0x200000
ja 0x43b408
mov eax, dword [ebp]
sub eax, 0x10
mov dword [esp + 0x10], edi
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
lea ecx, [ebx + 1]
sub eax, ecx
or edx, eax
mov esi, ebx
jge 0x43b390
push ecx
mov ecx, ebp
call fcn.00404ac0
mov edi, dword [ebp]
mov dword [esp + 0x1c], edi
jmp 0x43b3a0
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43b404
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43b404
sub esi, eax
add edi, eax
test esi, esi
jne 0x43b3a0
mov eax, dword [esp + 0x1c]
mov byte [eax + ebx], 0
mov ecx, dword [ebp]
test ecx, ecx
jne 0x43b3db
xor eax, eax
jmp 0x43b3ed
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x43b3e0
sub eax, esi
js 0x43b421
cmp eax, dword [ecx - 8]
jg 0x43b421
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp]
mov byte [eax + ecx], 0
mov dword [esp + 0x14], 1
mov esi, dword [esp + 0x20]
test esi, esi
je 0x43b413
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
push 0x80070057
call fcn.004011d0
int3
Function at 0x43b930
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x24c
mov eax, dword [0x4dffd0]
xor eax, esp
mov dword [esp + 0x248], eax
mov eax, dword [esp + 0x250]
push ebp
push esi
push edi
xor edi, edi
push 0x228
lea ecx, [esp + 0x30]
push edi
push ecx
mov dword [esp + 0x30], eax
xor esi, esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], edi
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push 2
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x28], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
jne 0x43b9ae
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0048e5b2
add esp, 0x24c
ret
push ebx
lea edx, [esp + 0x2c]
push edx
push ebp
mov dword [esp + 0x34], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x43bae2
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, edi
je 0x43b9df
push esi
call ebx
xor esi, esi
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x43b9ee
push eax
call ebx
mov dword [esp + 0x14], edi
lea eax, [esp + 0x50]
push 0x4b8c50
push eax
call dword [sym.imp.MSVCR80.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x43ba9b
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x43ba9b
mov eax, dword [esp + 0x264]
cmp dword [esp + 0x1c], eax
jne 0x43ba9b
mov ecx, dword [esp + 0x34]
push ecx
push edi
push 0x400
call ebp
mov esi, eax
cmp esi, edi
je 0x43ba9b
lea edx, [esp + 0x14]
push edx
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43ba9b
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
push ecx
push 1
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x34], edi
call fcn.0043b7b0
add esp, 0x10
test eax, eax
je 0x43ba9b
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ecx
call fcn.0043b670
add esp, 4
test eax, eax
je 0x43bab4
mov edx, dword [esp + 0x10]
push edx
call sub.MSVCR80.dll_free
add esp, 4
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x2c]
push eax
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43b9d6
jmp 0x43bad7
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
push ecx
mov dword [eax], edx
mov dword [esp + 0x24], 1
call sub.MSVCR80.dll_free
add esp, 4
mov dword [esp + 0x10], edi
cmp esi, edi
je 0x43bade
push esi
call ebx
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x43baf1
push eax
call ebx
mov dword [esp + 0x14], edi
push ebp
call ebx
mov ecx, dword [esp + 0x258]
mov eax, dword [esp + 0x20]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0048e5b2
add esp, 0x24c
ret
Function at 0x43bb90
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
xor edi, edi
push edi
push edi
push 2
push edi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43bbe5
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x18]
push edi
lea ecx, [esp + 0x14]
push ecx
push ebx
push edx
push esi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43bbdd
cmp dword [esp + 0x10], ebx
jne 0x43bbdd
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
ret 0xc

Function at 0x43bda0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 1
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x43be08
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b8c90
push esi
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x43be08
push esi
call ebp
xor esi, esi
test esi, esi
mov edi, dword [esp + 0x10]
je 0x43be13
push esi
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x43c4d0
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4abe50
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
mov dword [esp + 0x18], 0
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], esi
mov eax, dword [0x5006bc]
push eax
lea ecx, [esp + 0x14]
push str.SoftwareKingsoftKVip_d
push ecx
mov byte [esp + 0x30], 1
call fcn.00405e90
mov ebx, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 1
push esi
push ebx
push SysReAllocString
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43c588
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.Proxy_Mode
push esi
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
mov ebp, dword [esp + 0x18]
je 0x43c597
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c5bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x43c5d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4abe80
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
mov dword [esp + 0x14], 0x50
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], 0
mov eax, dword [0x5006bc]
push eax
lea ecx, [esp + 0x10]
push str.SoftwareKingsoftKVip_d
push ecx
mov byte [esp + 0x2c], 1
call fcn.00405e90
mov ebx, dword [esp + 0x18]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 1
push 0
push ebx
push SysReAllocString
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43c6ae
mov edi, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.Proxy_Port
push edi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43c6a3
cmp dword [esp + 0x10], 4
jne 0x43c6a3
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
test edi, edi
je 0x43c6ae
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43c6d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x18
ret 4

Function at 0x43c6f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4abeb6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.KDirectInfoc::KInstallSerialize.0
push 0x400
mov dword [esi + 8], 0x400
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
xor edi, edi
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
push 0x400
mov dword [esp + 0x20], edi
mov dword [esi + 0x14], 0x400
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
add esp, 8
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov word [esi + 0x2c], di
mov dword [esi + 0x30], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x43c7d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4abc38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4dffd0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x500de4]
mov edx, dword [eax + 0xc]
mov ecx, 0x500de4
or ebp, 0xffffffff
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
push eax
push ecx
push 0
mov dword [esp + 0x2c], 0
call fcn.0043f440
push 0
mov edi, eax
call dword [sym.imp.MSVCR80.dll__time32]
add esp, 0x10
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
movzx eax, word [esi + 0x2c]
shr edx, 6
imul edx, edx, 0x3e8
sub ecx, edx
push ecx
mov ecx, dword [esp + 0x2c]
push ebx
push edi
push eax
push ecx
lea edx, [esp + 0x28]
push 0x4b8d8c
push edx
call fcn.00405e90
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
mov edi, dword [esp + 0x30]
add esp, 0x1c
push eax
push ecx
push edi
mov ecx, esi
call fcn.0043bb90
test eax, eax
je 0x43c889
xor ebp, ebp
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c8ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4