Function at 0x433fe0
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3cc0
mov eax, dword fs:[0]
push eax
sub esp, 0x530
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x530], ecx
call fcn.00425290
mov ecx, eax
call fcn.00435f00
mov ecx, eax
call fcn.0042eb30
movzx eax, al
test eax, eax
jne 0x434044
push 0x40
push 0x4faba8
push 0x4fabb0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4342cd
lea ecx, [ebp - 0x58]
push ecx
call fcn.00425290
mov ecx, eax
call fcn.004363c0
mov dword [ebp - 0x528], eax
mov edx, dword [ebp - 0x528]
mov dword [ebp - 0x52c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x52c]
call fcn.00402fb0
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00402070
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00404c10
push 0x4fabd4
lea ecx, [ebp - 0x28]
call fcn.004043f0
push eax
call fcn.00425290
mov ecx, eax
call fcn.00435f00
mov ecx, eax
call fcn.0042e5d0
test eax, eax
jle 0x4340de
push 0x40
push 0x4fabe4
push 0x4fabf0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404860
jmp 0x4342cd
call fcn.00425290
mov ecx, eax
call fcn.00435f00
mov ecx, eax
call fcn.0042e3a0
movzx ecx, al
test ecx, ecx
jne 0x43410c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404860
jmp 0x4342cd
call fcn.00425290
mov ecx, eax
call fcn.00435f80
mov ecx, eax
call fcn.004378d0
call fcn.00425290
mov ecx, eax
call fcn.00435ed0
push eax
mov ecx, dword [ebp - 0x530]
call fcn.004343d0
lea ecx, [ebp - 0x520]
call fcn.00434570
mov byte [ebp - 4], 3
mov dword [ebp - 0x534], 0x100
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x534]
push edx
push 0x10ce0000
push 0x4fac60
push 0
lea ecx, [ebp - 0x520]
call fcn.0045341a
lea ecx, [ebp - 0x520]
call fcn.004532c6
push 1
push 1
lea ecx, [ebp - 0x520]
call fcn.004537f3
call fcn.0044a00a
call fcn.0044c0b7
call fcn.00425290
mov ecx, eax
call fcn.004365d0
movzx eax, al
test eax, eax
je 0x4342af
call fcn.00425290
mov ecx, eax
call fcn.00436690
movzx ecx, al
test ecx, ecx
je 0x434215
push 9
push 0
push 0x4fac78
lea edx, [ebp - 0x70]
push edx
call fcn.00425290
mov ecx, eax
call fcn.00436320
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x53c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x53c]
call fcn.00402fb0
push eax
call fcn.00402370
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.00404c10
mov dword [ebp - 0x524], 0
call fcn.00425290
mov ecx, eax
call fcn.004366d0
movzx ecx, al
test ecx, ecx
je 0x43423c
mov dword [ebp - 0x524], str._regall
cmp dword [ebp - 0x524], 0
je 0x434289
lea edx, [ebp - 0x40]
push edx
call fcn.00425290
mov ecx, eax
call fcn.00436320
mov byte [ebp - 4], 5
push 1
push str.runas
mov eax, dword [ebp - 0x524]
push eax
push str.PhotoViewer.exe
lea ecx, [ebp - 0x40]
call fcn.00402fb0
push eax
call fcn.004024b0
add esp, 0x14
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00404c10
call fcn.00425290
mov ecx, eax
call fcn.00436550
movzx ecx, al
test ecx, ecx
je 0x4342af
call fcn.00425290
mov ecx, eax
call fcn.00435f80
mov ecx, eax
call fcn.00437ae0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x520]
call fcn.004346a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404860
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret