joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a44d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c8678]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00404770
mov dword [esi], vtable.boost::gregorian::bad_year.0
test edi, edi
mov dword [esp + 0x18], 0
je 0x4256aa
add edi, 0x28
jmp 0x4256ac
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x4256c4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x425700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a44d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c8678]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00404770
mov dword [esi], vtable.boost::gregorian::bad_month.0
test edi, edi
mov dword [esp + 0x18], 0
je 0x42574a
add edi, 0x28
jmp 0x42574c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x425764
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4285e0
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0
push 1
push 0
mov ebp, ecx
call dword [0x4ae0f0]
mov esi, dword [esp + 0x20]
mov ebx, eax
test ebx, ebx
mov dword [esi + 4], ebx
jne 0x42863e
call dword [0x4ae2e0]
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov dword [esp + 0x14], edi
call fcn.0049fa70
neg edi
sbb edi, edi
test edi, fcn.0040cb00
mov dword [esp + 0x18], eax
je 0x42863e
push str.thread.entry_event
lea eax, [esp + 0x18]
push eax
call fcn.004136e0
push 0
push 0
push 1
push 0
call dword [0x4ae0f0]
mov dword [ebp + 8], eax
mov dword [esi + 8], eax
cmp dword [ebp + 8], 0
jne 0x428692
call dword [0x4ae2e0]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov dword [esp + 0x14], edi
call fcn.0049fa70
neg edi
sbb edi, edi
test edi, fcn.0040cb00
mov dword [esp + 0x18], eax
je 0x428692
push str.thread.exit_event
lea ecx, [esp + 0x18]
push ecx
call fcn.004136e0
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x10]
push edx
push 0
push esi
push 0x41f160
push eax
push 0
mov dword [esp + 0x28], 0
call fcn.00471b34
add esp, 0x18
test eax, eax
mov dword [ebp + 4], eax
jne 0x428710
call dword [0x4ae2e0]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
test ebx, ebx
je 0x4286da
push ebx
call dword [0x4ae2d8]
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x4286e8
push ebp
call dword [0x4ae2d8]
mov dword [esp + 0x14], edi
call fcn.0049fa70
neg edi
sbb edi, edi
test edi, fcn.0040cb00
mov dword [esp + 0x18], eax
je 0x428710
push str.thread
lea ecx, [esp + 0x18]
push ecx
call fcn.004136e0
test ebx, ebx
je 0x428724
push 0xffffffffffffffff
push ebx
call dword [0x4ae288]
push ebx
call dword [0x4ae2d8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x42aad0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a4c81
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4c8678]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov dword [esi], eax
mov al, byte [esp + 0x38]
mov dword [esi + 8], edx
lea edx, [esp + 0x3c]
mov dword [esi + 4], ecx
mov edi, 1
lea ecx, [esi + 0x10]
push edx
mov dword [esp + 0x24], edi
mov byte [esi + 0xc], al
call fcn.00429a60
mov eax, dword [esp + 0x40]
mov edx, dword [eax]
push eax
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x14], edi
push edx
mov edi, ecx
push edi
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x34], 0
call fcn.00426480
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0046fbc9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x42e0a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2f0
mov eax, dword [0x4c8678]
xor eax, esp
mov dword [esp + 0x2ec], eax
mov eax, dword [esp + 0x2fc]
push ebx
mov ebx, dword [esp + 0x304]
push ebp
mov ebp, dword [esp + 0x30c]
push esi
mov esi, dword [esp + 0x304]
push edi
mov edi, dword [esp + 0x304]
push 0x64
lea ecx, [esp + 0x30]
push 0
push ecx
mov dword [esp + 0x30], eax
call fcn.004700e0
mov edx, ebx
shr edx, 8
movzx eax, dl
movzx ecx, bl
shl ecx, 8
or eax, ecx
shl eax, 8
mov edx, ebx
shr edx, 0x10
movzx ecx, dl
or eax, ecx
shl eax, 8
shr ebx, 0x18
or eax, ebx
push eax
mov eax, dword [esp + 0x34]
xor ecx, ecx
mov edx, eax
shr edx, 0x10
mov ch, dl
mov edx, eax
shr edx, 0x18
mov cl, dl
push ecx
mov ecx, eax
shr ecx, 8
movzx eax, al
movzx edx, cl
shl eax, 8
or edx, eax
push edx
mov ecx, esi
movzx edx, si
mov esi, dword [0x4ae394]
shr ecx, 0x10
push ecx
push edx
push edi
push str._X__X__X__X__X_X
lea eax, [esp + 0x54]
push 0x63
push eax
call esi
lea ecx, [esp + 0x5c]
push ecx
push str.CLSID_sLocalServer32
lea edx, [esp + 0x12c]
push 0x103
push edx
call esi
add esp, 0x40
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xf8]
push ecx
push 0x80000000
call dword [0x4ae03c]
test eax, eax
jne 0x42e1c9
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push ebp
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], 0x104
call dword [0x4ae00c]
test eax, eax
je 0x42e1cd
mov edx, dword [esp + 0x10]
push edx
call dword [0x4ae030]
xor al, al
jmp 0x42e1da
mov eax, dword [esp + 0x10]
push eax
call dword [0x4ae030]
mov al, 1
mov ecx, dword [esp + 0x2fc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046fb90
add esp, 0x2f0
ret
Function at 0x435300
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esi + 8]
push eax
push 0x441930
push 0
push 0
mov byte [esi + 0x18], 0
mov dword [eax], esi
mov dword [esi + 0xc], ecx
call fcn.00471b34
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x43533c
mov dword [esi + 4], 0
cmp dword [esi + 4], 0
jne 0x43534d
mov byte [esi + 0x18], 1
xor al, al
pop esi
pop ecx
ret 4
mov al, 1
pop esi
pop ecx
ret 4

Function at 0x436070
Capabilities:
Get file version info

Disassembly:
sub esp, 0x34
push ebx
push esi
push edi
mov esi, ecx
push 0
lea ebx, [esi + 0x30]
push ebx
call fcn.004a0b72
mov edi, eax
test edi, edi
jne 0x436092
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x34
ret
push edi
call fcn.00470180
push edi
push 0
push eax
mov dword [esi + 8], eax
call fcn.004700e0
mov eax, dword [esi + 8]
add esp, 0x10
push eax
push edi
push 0
push ebx
call fcn.004a0b6c
test eax, eax
je 0x436089
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00435d50
test eax, eax
je 0x436089
mov eax, dword [esp + 0x14]
mov edx, eax
mov word [esi + 0xe], ax
mov eax, dword [esp + 0x18]
shr edx, 0x10
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x1c]
shr ecx, 0x10
mov word [esi + 0xc], dx
mov edx, eax
mov word [esi + 0x10], cx
mov word [esi + 0x16], ax
mov eax, dword [esp + 0x20]
mov ecx, eax
shr ecx, 0x10
mov word [esi + 0x18], cx
mov ecx, dword [esp + 0x2c]
shr edx, 0x10
mov word [esi + 0x14], dx
mov edx, dword [esp + 0x24]
mov word [esi + 0x1a], ax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x24], ecx
push 0x104
lea ecx, [esi + 0x238]
push ecx
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x3c]
push 0x4b0e58
mov ecx, esi
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
call fcn.00435e90
test eax, eax
je 0x436089
push 0x104
lea edx, [esi + 0x648]
push edx
push 0x4b0e38
mov ecx, esi
call fcn.00435e90
test eax, eax
je 0x436089
push 0x104
lea eax, [esi + 0x440]
push eax
push 0x4b0e20
mov ecx, esi
call fcn.00435e90
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
add esp, 0x34
ret
Function at 0x438cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a6008
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4c8678]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push esi
mov eax, dword [0x4c8678]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00450550
xor ebx, ebx
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], ebx
call fcn.00450e20
test al, al
jne 0x438d4c
push ebx
call dword [0x4ae570]
lea eax, [esp + 0x10]
push eax
call dword [0x4ae598]
test eax, eax
jne 0x438d44
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov bl, 1
call dword [0x4ae574]
jmp 0x438d4e
mov bl, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00438cb0
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0046fb90
add esp, 0x24
ret

Function at 0x4397c0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x4c8678]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [section..rdata]
cmp eax, ebx
mov dword [esp + 4], eax
je 0x43983b
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [0x4ae004]
test eax, eax
jne 0x43982a
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [0x4ae008]
mov eax, dword [esp + 4]
cmp eax, ebx
mov ecx, dword [esp + 0x14]
setne al
pop ebx
xor ecx, esp
call fcn.0046fb90
add esp, 0x14
ret
Function at 0x43a3e0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x4a6173
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x4c8678]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c8678]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov esi, dword [esp + 0x270]
mov ebp, dword [esp + 0x274]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov dword [esp + 0x50], esi
mov word [esi + 4], bx
push 0x208
lea eax, [esp + 0x58]
push ebx
mov edi, 1
push eax
mov dword [esp + 0x274], ebx
mov dword [esp + 0x20], edi
call fcn.004700e0
add esp, 0xc
push edi
push 0x2b
lea ecx, [esp + 0x5c]
push ecx
push ebx
call dword [0x4ae38c]
test eax, eax
je 0x43a587
lea eax, [esp + 0x54]
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x43a493
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x58]
push edx
lea ecx, [esp + 0x3c]
call fcn.00409bb0
push str.TencentQQDownload
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x274], edi
call fcn.0040a2a0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x274], 2
call fcn.004099b0
mov edi, 8
cmp dword [esp + 0x30], edi
jb 0x43a4fa
mov edx, dword [esp + 0x1c]
push edx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x4c], edi
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
mov byte [esp + 0x268], bl
jb 0x43a525
mov eax, dword [esp + 0x38]
push eax
call fcn.0046fbc9
add esp, 4
cmp dword [ebp + 0x14], ebx
je 0x43a56d
push ebp
lea ecx, [esp + 0x1c]
push 0x4af774
push ecx
call fcn.00430400
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov dword [esp + 0x274], 3
call fcn.004099b0
cmp dword [esp + 0x30], edi
mov byte [esp + 0x268], bl
jb 0x43a56d
mov edx, dword [esp + 0x1c]
push edx
call fcn.0046fbc9
add esp, 4
push esi
call fcn.00439dc0
add esp, 4
test al, al
jne 0x43a594
push esi
call fcn.00439f20
add esp, 4
cmp al, bl
jne 0x43a594
push ebx
push 0x4b0828
mov ecx, esi
call fcn.00409bb0
mov eax, esi
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0046fb90
add esp, 0x258
ret
Function at 0x43a5c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a61d1
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x4c8678]
xor eax, esp
mov dword [esp + 0x46c], eax
push ebx
push esi
mov eax, dword [0x4c8678]
xor eax, esp
push eax
lea eax, [esp + 0x47c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x48c]
xor ebx, ebx
test byte [0x4cacd8], 1
mov dword [esp + 0xc], ebx
jne 0x43a63a
or dword [0x4cacd8], 1
push 0x4ace00
mov dword [0x4cacd4], 7
mov dword [0x4cacd0], ebx
mov word [0x4cacc0], bx
call fcn.00470938
add esp, 4
cmp dword [0x4cacd0], ebx
jne 0x43a7bc
push 0x208
lea eax, [esp + 0x274]
push ebx
push eax
call fcn.004700e0
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x278]
push ecx
push ebx
call dword [0x4ae38c]
test eax, eax
je 0x43a726
lea edx, [esp + 0x270]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040a260
push str.TencentTencentdl
push eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x490], ebx
call fcn.0040a2a0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x4cacbc
mov byte [esp + 0x490], 1
call fcn.004099b0
cmp dword [esp + 0x44], 8
jb 0x43a6cc
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x60], 8
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
mov dword [esp + 0x484], 0xffffffff
jb 0x43a6fc
mov edx, dword [esp + 0x4c]
push edx
call fcn.0046fbc9
add esp, 4
push 0x4cacbc
call fcn.00439dc0
add esp, 4
test al, al
jne 0x43a7bc
push 0x4cacbc
call fcn.00439f20
add esp, 4
cmp al, bl
jne 0x43a7bc
push 0x208
lea eax, [esp + 0x6a]
push ebx
push eax
mov word [esp + 0x70], bx
call fcn.004700e0
add esp, 0xc
push 0x20a
lea ecx, [esp + 0x68]
push ecx
push ebx
call dword [0x4ae2cc]
lea edx, [esp + 0x64]
push 0x5c
push edx
call fcn.00472542
add esp, 8
cmp eax, ebx
je 0x43a765
mov word [eax], bx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x14]
call fcn.0040a260
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x4cacbc
mov dword [esp + 0x490], 2
call fcn.00409ac0
cmp dword [esp + 0x28], 8
mov dword [esp + 0x484], 0xffffffff
jb 0x43a7ab
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0046fbc9
add esp, 4
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], bx
push 0xffffffffffffffff
push ebx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0x4cacbc
mov ecx, esi
mov word [esi + 4], bx
call fcn.00409ac0
mov eax, esi
mov ecx, dword [esp + 0x47c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x46c]
xor ecx, esp
call fcn.0046fb90
add esp, 0x47c
ret
Function at 0x43a810
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x4a624b
mov eax, dword fs:[0]
push eax
sub esp, 0x458
mov eax, dword [0x4c8678]
xor eax, esp
mov dword [esp + 0x454], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c8678]
xor eax, esp
push eax
lea eax, [esp + 0x46c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x47c]
xor ebx, ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov ebp, 7
mov edi, 1
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
mov dword [esp + 0x474], edi
mov word [esi + 4], bx
push 0x208
lea eax, [esp + 0x264]
push ebx
push eax
mov dword [esp + 0x3c], edi
call fcn.004700e0
mov cl, byte [esp + 0x4ac]
add esp, 0xc
neg cl
push edi
lea edx, [esp + 0x264]
sbb ecx, ecx
and ecx, 0xfffffff7
add ecx, 0x23
push ecx
push edx
push ebx
call dword [0x4ae38c]
test eax, eax
lea edi, [ebx + 8]
je 0x43a988
lea eax, [esp + 0x260]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x43a8d5
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0x1c]
call fcn.00409bb0
lea ecx, [esp + 0x484]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x480], 2
call fcn.00414360
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x480], 3
call fcn.004099b0
cmp dword [esp + 0x50], edi
jb 0x43a93e
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x2c], edi
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
mov byte [esp + 0x474], 1
jb 0x43a966
mov edx, dword [esp + 0x18]
push edx
call fcn.0046fbc9
add esp, 4
push esi
call fcn.00439dc0
add esp, 4
test al, al
jne 0x43aa28
push esi
call fcn.00439f20
add esp, 4
cmp al, bl
jne 0x43aa28
push 0x208
lea eax, [esp + 0x5a]
push ebx
push eax
mov word [esp + 0x60], bx
call fcn.004700e0
add esp, 0xc
push 0x20a
lea ecx, [esp + 0x58]
push ecx
push ebx
call dword [0x4ae2cc]
lea edx, [esp + 0x54]
push 0x5c
push edx
call fcn.00472542
add esp, 8
cmp eax, ebx
je 0x43a9c7
mov word [eax], bx
lea eax, [esp + 0x54]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea edx, [eax + 2]
jmp 0x43a9e0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x43a9e0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x1c]
call fcn.00409bb0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov byte [esp + 0x480], 4
call fcn.00409ac0
cmp dword [esp + 0x2c], edi
jb 0x43aa28
mov edx, dword [esp + 0x18]
push edx
call fcn.0046fbc9
add esp, 4
cmp dword [esp + 0x49c], edi
jb 0x43aa41
mov eax, dword [esp + 0x488]
push eax
call fcn.0046fbc9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x46c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x454]
xor ecx, esp
call fcn.0046fb90
add esp, 0x464
ret
Function at 0x43b450
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a63fe
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c8678]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x4b11e4
push fcn.00408cf0
push 3
push 4
lea eax, [esi + 0x34]
push eax
mov dword [esp + 0x28], 2
call fcn.0047041a
mov eax, dword [esi + 0x30]
mov edi, dword [0x4ae328]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4c7100]
mov byte [esp + 0x18], 1
je 0x43b4cb
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x43b4cb
mov eax, dword [esi + 0x30]
sub eax, 0xc
push eax
call fcn.0046fe7a
add esp, 4
mov eax, dword [esi + 0x2c]
lea edx, [eax - 0xc]
cmp edx, dword [0x4c7100]
mov byte [esp + 0x18], 0
je 0x43b4f7
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x43b4f7
mov eax, dword [esi + 0x2c]
sub eax, 0xc
push eax
call fcn.0046fe7a
add esp, 4
mov esi, dword [esi + 0x14]
test esi, esi
mov dword [esp + 0x18], 0xffffffff
je 0x43b50c
push esi
call fcn.0049e3ba
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x43b9e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a63fe
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4c8678]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [0x4ae418]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi], 0x4b11e4
mov dword [esi + 0x24], ebx
mov ecx, dword [0x4c7104]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ecx
mov edx, dword [0x4c7104]
mov dword [esi + 0x30], edx
push fcn.00408cf0
push 0x408e90
push 3
push 4
lea eax, [esi + 0x34]
push eax
mov byte [esp + 0x2c], 2
call fcn.0047124c
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov byte [esi + 0x94], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x440f00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [0x4c8678]
xor eax, esp
mov dword [esp + 0x118], eax
push ebp
push esi
mov esi, dword [esp + 0x128]
push edi
mov edi, dword [0x4ae024]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov ebp, 3
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call edi
test eax, eax
jne 0x441094
push esi
push str._sConnection
lea ecx, [esp + 0x28]
push 0x103
push ecx
call fcn.00440ee0
mov ecx, dword [esp + 0x2c]
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
lea eax, [esp + 0x2c]
push eax
push ecx
call edi
test eax, eax
mov edi, dword [0x4ae030]
jne 0x44108d
mov esi, dword [0x4ae020]
mov eax, 4
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.MediaSubType
push edx
call esi
test eax, eax
jne 0x441086
push 0x104
push eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x103
call fcn.004700e0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.PnpInstanceID
push ecx
call esi
test eax, eax
jne 0x441086
mov esi, 1
cmp dword [esp + 0xc], esi
jne 0x441076
push ebp
lea edx, [esp + 0x24]
push 0x4b1488
push edx
call fcn.00473290
add esp, 0xc
test eax, eax
jne 0x441051
xor ebp, ebp
jmp 0x441086
cmp dword [esp + 0xc], esi
jne 0x441076
push 3
lea eax, [esp + 0x24]
push 0x4b1488
push eax
call fcn.00473290
add esp, 0xc
test eax, eax
je 0x441076
mov ebp, 2
jmp 0x441086
xor ecx, ecx
cmp dword [esp + 0xc], 2
setne cl
lea ecx, [ecx + ecx + 1]
mov ebp, ecx
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0x1c]
push eax
call edi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0046fb90
add esp, 0x11c
ret