Function at 0x43d450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c8
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [0x4bde88], ecx
push ebx
mov bl, byte [ebp + 8]
setne cl
movzx eax, bl
cmp ecx, eax
jne 0x43d48a
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 1
je 0x43d479
cmp byte [0x4bdee8], 0
push esi
jne 0x43d4ea
push edi
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.StartTraceW
push edi
call esi
push str.ControlTraceW
push edi
mov dword [0x4bdec4], eax
call esi
push str.OpenTraceW
push edi
mov dword [0x4bdec8], eax
call esi
push str.ProcessTrace
push edi
mov dword [0x4bdecc], eax
call esi
mov dword [0x4bded0], eax
mov byte [0x4bdee8], 1
pop edi
cmp dword [0x4bdec4], 0
jne 0x43d508
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
push 0x4f4
lea eax, [ebp - 0x5c0]
push 0
push eax
call fcn.00471730
add esp, 0xc
mov dword [ebp - 0x5c4], 0x4f8
mov dword [ebp - 0x598], 0x20000
mov dword [ebp - 0x580], 1
call fcn.00436bc0
movzx eax, al
neg eax
mov dword [ebp - 0x59c], 1
sbb eax, eax
and eax, 0x2000000
or eax, 0x100
mov dword [ebp - 0x584], eax
call fcn.00436bc0
test al, al
jne 0x43d57b
movdqu xmm0, xmmword [0x4a3c4c]
movdqu xmmword [ebp - 0x5ac], xmm0
mov dword [ebp - 0x554], 0x78
mov dword [ebp - 0x558], 0x280
call fcn.00436bc0
test al, al
mov edx, str.NT_Kernel_Logger
mov ecx, str.PROCMON_TRACE
lea eax, [ebp - 0x54c]
cmove ecx, edx
push ecx
push 0x104
push eax
call fcn.00470605
push 0x490b00
lea eax, [ebp - 0x344]
push 0x104
push eax
call fcn.00470605
add esp, 0x18
call fcn.0043d320
test al, al
jne 0x43d5e6
or dword [ebp - 0x57c], 0x10000
jmp 0x43d66b
movdqu xmm0, xmmword [0x4a4128]
mov dword [ebp - 0x57c], connect
mov eax, 0x488
mov byte [ebp - 0x57a], 0xff
movdqu xmmword [ebp - 0x110], xmm0
mov word [ebp - 0x57c], ax
movdqu xmm0, xmmword [0x4a4138]
mov dword [ebp - 0x138], 0x10009
mov dword [ebp - 0x134], 0x10000
movdqu xmmword [ebp - 0x100], xmm0
mov dword [ebp - 0x114], 0x30011
movdqu xmm0, xmmword [0x4a4148]
mov dword [ebp - 0x13c], 0x2001b
movdqu xmmword [ebp - 0xf0], xmm0
movdqu xmm0, xmmword [0x4a4158]
movdqu xmmword [ebp - 0xe0], xmm0
test bl, bl
je 0x43d708
lea eax, [ebp - 0x5c4]
push eax
lea eax, [ebp - 0x54c]
push eax
push 0x4bdee0
call dword [0x4bdec4]
mov esi, eax
test esi, esi
je 0x43d6d7
cmp esi, 0xb7
je 0x43d6d7
push esi
lea eax, [ebp - 0xcc]
push str.Network_trace_initialization_failed:_Error__d
push eax
call fcn.0043c710
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0x10
push 0x49794c
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
xor esi, esi
lea eax, [ebp - 0x5c8]
push eax
push esi
push esi
push 0x43c740
push esi
push esi
call fcn.00474460
add esp, 0x18
mov dword [0x4bde88], eax
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
push dword [0x4bde90]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 1
lea eax, [ebp - 0x5c4]
push eax
lea eax, [ebp - 0x54c]
push eax
push dword [0x4bdee4]
push dword [0x4bdee0]
call dword [0x4bdec8]
push 0xffffffffffffffff
push dword [0x4bde88]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x4bde88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x4bde90]
mov dword [0x4bde88], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00470e77
mov esp, ebp
pop ebp
ret