Function at 0x451d40
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63cf46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa08
mov eax, dword [0x6cdb00]
push ebx
push esi
push edi
mov dword [ebp - 0x7c], ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x14]
push ebx
push ecx
neg eax
push ebx
push 0xf003f
sbb eax, eax
push ebx
and eax, 0xf
push ebx
push ebx
add eax, 0xf
push str.SoftwareDownloadManager_
push 0x80000001
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [0x6cdb04], eax
mov byte [ebp - 0x35], bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x451de9
mov edx, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
push str.Extensions
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x451de9
mov edi, str.3GP_7Z_AAC_ACE_AIF_ARJ_ASF_AVI_BIN_BZ2_EXE_GZ_GZIP_IMG_ISO_LZH_M4A_M4V_MKV_MOV_MP3_MP4_MPA_MPE_MPEG_MPG_MSI_MSU_OGG_OGV_PDF_PLJ_PPS_PPT_QT_R0_R1_RA_RAR_RM_RMVB_SEA_SIT_SITX_TAR_TIF_TIFF_WAV_WMA_WMV_Z_ZIP
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
not ecx
push ecx
push str.3GP_7Z_AAC_ACE_AIF_ARJ_ASF_AVI_BIN_BZ2_EXE_GZ_GZIP_IMG_ISO_LZH_M4A_M4V_MKV_MOV_MP3_MP4_MPA_MPE_MPEG_MPG_MSI_MSU_OGG_OGV_PDF_PLJ_PPS_PPT_QT_R0_R1_RA_RAR_RM_RMVB_SEA_SIT_SITX_TAR_TIF_TIFF_WAV_WMA_WMV_Z_ZIP
push 1
push ebx
push str.Extensions
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 0x35], 1
mov ecx, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
push str.LocalPathW
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x451e57
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x30], bx
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 1
push edx
call fcn.0044d070
add esp, 4
test al, al
je 0x451e4b
mov eax, dword [ebp - 0x34]
cmp eax, ebx
jne 0x451e80
lea eax, [ebp - 0x30]
lea esi, [ebp - 0x30]
push eax
call fcn.00609a4e
mov ecx, dword [ebp - 0x14]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push esi
push ebx
push ebx
push str.LocalPathW
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.00401070
mov edx, dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push ebx
push ebx
push ebx
push str.TempPath
push edx
call esi
test eax, eax
je 0x451eb3
mov eax, dword [0x6fca48]
cmp eax, ebx
jne 0x451e84
mov eax, 0x6fca4c
jmp 0x451e88
mov esi, eax
jmp 0x451e2b
mov esi, eax
jmp 0x451e8d
mov esi, 0x6fca4c
push eax
call fcn.00609a4e
mov ecx, dword [ebp - 0x14]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
push str.TempPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4521ad
lea edx, [ebp - 0x44]
push edx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4521ad
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x4bc]
push eax
push ecx
push ebx
push ebx
push 0x6cc0c4
push edx
mov dword [ebp - 0x28], 0x208
call esi
test eax, eax
jne 0x4521a1
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x30], bx
mov eax, 0x6c910c
mov byte [ebp - 4], 2
test eax, eax
je 0x451fe7
lea ecx, [ebp - 0x4bc]
test ecx, ecx
je 0x451fe7
lea edx, [ebp - 0x4bc]
lea ecx, [ebp - 0x5c]
push edx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x58], bx
call fcn.00401f20
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00401070
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x4c], bx
push ebx
push 0x6c910c
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.004027e0
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x5c]
call fcn.00401f10
push eax
call fcn.00609a4e
lea esi, [eax + esi + 2]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 8
cmp edx, ebx
mov dword [ebp - 0x34], edx
je 0x451fcf
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x5c]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x50]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x34]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00609a4e
add esp, 0x14
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 3
call fcn.00401070
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.00401070
lea edx, [ebp - 0x4bc]
push 0x7e
push edx
call fcn.0060a17b
add esp, 8
test eax, eax
je 0x452105
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x6c2]
mov word [ebp - 0x6c4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x6c4]
lea ecx, [ebp - 0x4bc]
push eax
push ecx
call fcn.00453970
mov edx, 0x6c910c
add esp, 8
test edx, edx
je 0x452105
test eax, eax
je 0x452105
xor ecx, ecx
push eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], ecx
mov word [ebp - 0x4c], cx
lea ecx, [ebp - 0x50]
call fcn.00401f20
mov bl, 5
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00401070
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], eax
mov word [ebp - 0x58], ax
push eax
push 0x6c910c
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 6
call fcn.004027e0
mov esi, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
call fcn.00401f10
push eax
call fcn.00609a4e
lea esi, [eax + esi + 2]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x34], edx
je 0x4520ee
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x50]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x5c]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x34]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00609a4e
add esp, 0x14
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00401070
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x4bc]
push edx
push eax
push 0
push 0
push str.TempPath
push ecx
mov dword [ebp - 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x452195
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x452166
lea eax, [ebp - 0x30]
lea esi, [ebp - 0x30]
push eax
call fcn.00609a4e
push eax
lea edx, [ebp - 0x4bc]
push esi
push edx
call fcn.0061f2f2
add esp, 0x10
test eax, eax
jne 0x452195
mov eax, dword [0x6fca48]
test eax, eax
jne 0x45216a
mov eax, 0x6fca4c
jmp 0x45216e
mov esi, eax
jmp 0x45213b
mov esi, eax
jmp 0x452173
mov esi, 0x6fca4c
push eax
call fcn.00609a4e
mov ecx, dword [ebp - 0x14]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push str.TempPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.00401070
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push ebx
push ebx
push str.FindApps
push edx
mov dword [ebp - 0x3c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4521ec
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push ebx
push str.FindApps
push ecx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.0044b080
mov eax, dword [0x6fca30]
cmp eax, ebx
jne 0x4521ff
mov eax, 0x6fca34
push eax
call fcn.0044d770
add esp, 4
test al, al
jne 0x45221f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6fca30]
cmp eax, ebx
jne 0x452278
mov eax, 0x6fca34
mov esi, eax
push eax
call fcn.00609a4e
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [ebp - 0x14]
push edx
push esi
push 1
push ebx
push 0x6ce95c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [0x6f7b78]
mov dword [ebp - 0x40], ecx
mov eax, dword [0x6cdb00]
mov byte [ebp - 4], 7
cmp eax, ebx
je 0x45227c
mov edx, dword [0x6fc934]
lea eax, [ebp - 0x40]
push edx
push str._s_Trial
push eax
jmp 0x45228c
mov esi, eax
jmp 0x45222f
mov ecx, dword [0x6fc934]
lea edx, [ebp - 0x40]
push ecx
push str._s_Full
push edx
call fcn.0061fae1
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x1b4]
push eax
push ecx
push ebx
push ebx
push str.idmvers
push edx
mov dword [ebp - 0x90], 0x40
call esi
test eax, eax
jne 0x452339
mov edx, dword [0x6fc934]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x1b4]
push ecx
push edx
push eax
call fcn.00609d70
add esp, 0xc
test eax, eax
je 0x4522f2
mov dword [0x6fcaec], 1
push 8
lea ecx, [ebp - 0x1b4]
push str.v6.35b09
push ecx
call fcn.0060bf70
add esp, 0xc
test eax, eax
je 0x45232a
push 8
lea edx, [ebp - 0x1b4]
push str.v6.35b10
push edx
call fcn.0060bf70
add esp, 0xc
test eax, eax
jne 0x4523e7
mov dword [0x6fcaf0], 1
jmp 0x4523e7
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x20]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push 0x6fc418
push ebx
push str.SoftwareDownloadManagermenuExt
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4523e7
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x18]
push edx
push eax
push ebx
push ebx
mov edi, 4
push str.ffdownlFLV_v
push ecx
mov dword [ebp - 0x28], edi
call esi
test eax, eax
je 0x4523a4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
push edi
push edx
push edi
push ebx
push str.ffdownlFLV_v
push eax
mov dword [ebp - 0x18], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x18]
push ecx
push edx
push ebx
push ebx
push str.ffdownl10FLV_v
push eax
mov dword [ebp - 0x28], edi
call esi
test eax, eax
je 0x4523dd
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
push edi
push ecx
push edi
push ebx
push str.ffdownl10FLV_v
push edx
mov dword [ebp - 0x18], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x40]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 1
push ebx
push str.idmvers
push ecx
call esi
mov edx, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
push str.LstCheck
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x452457
lea eax, [ebp - 0xd8]
push eax
call fcn.0060bedd
lea edi, [ebp - 0xd8]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [ebp - 0x14]
dec ecx
push ecx
lea ecx, [ebp - 0xd8]
push ecx
push 1
push ebx
push str.LstCheck
push edx
call esi
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push ebx
push ebx
mov edi, 1
push str.LaunchOnStart
push edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x3c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x45249a
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push ebx
push str.LaunchOnStart
push ecx
mov dword [ebp - 0x1c], edi
call esi
cmp dword [ebp - 0x1c], ebx
je 0x452645
lea edx, [ebp - 0x44]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x452645
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x30], bx
mov eax, dword [0x6fca30]
mov byte [ebp - 4], 8
cmp eax, ebx
jne 0x4524e5
mov eax, 0x6fca34
mov ecx, str._s__onboot
test ecx, ecx
je 0x4525bc
cmp eax, ebx
je 0x4525bc
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x4c], bx
call fcn.00401f20
mov bl, 9
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00401070
xor esi, esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x54], esi
mov word [ebp - 0x58], si
push esi
push str._s__onboot
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xa
call fcn.004027e0
mov eax, dword [ebp - 0x50]
cmp eax, esi
jne 0x452542
lea eax, [ebp - 0x4c]
mov esi, dword [ebp - 0x54]
push eax
call fcn.00609a4e
lea esi, [eax + esi + 2]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x34], edx
je 0x4525a3
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x50]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x5c]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x34]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00609a4e
add esp, 0x14
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 8
call fcn.00401070
xor ebx, ebx
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x64]
lea eax, [ebp - 0x8cc]
push edx
push eax
push ebx
push ebx
push 0x6ce8d0
push ecx
mov dword [ebp - 0x64], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x452601
mov eax, dword [ebp - 0x34]
cmp eax, ebx
jne 0x4525ed
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x8cc]
push eax
push edx
call fcn.0060c3d3
add esp, 8
test eax, eax
je 0x452633
mov eax, dword [ebp - 0x34]
cmp eax, ebx
jne 0x45285f
lea eax, [ebp - 0x30]
lea esi, [ebp - 0x30]
push eax
call fcn.00609a4e
mov ecx, dword [ebp - 0x44]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
push 0x6ce8d0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 7
call fcn.00401070
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push ebx
push ebx
push ebx
push str.RememberLastSave
push edx
mov dword [ebp - 0x1c], 1
call edi
test eax, eax
je 0x452679
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push ebx
push str.RememberLastSave
push ecx
call esi
mov edx, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
push str.MonitorUrlClipboard
push edx
mov dword [ebp - 0x1c], ebx
call edi
test eax, eax
je 0x4526a3
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push ebx
push str.MonitorUrlClipboard
push ecx
call esi
mov edx, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
push str.UseHttpProxy
push edx
mov dword [ebp - 0x1c], ebx
call edi
test eax, eax
je 0x4526cd
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push ebx
push str.UseHttpProxy
push ecx
call esi
mov edx, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
push str.UseFtpProxy
push edx
mov dword [ebp - 0x1c], ebx
call edi
test eax, eax
je 0x4526f7
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push ebx
push str.UseFtpProxy
push ecx
call esi
mov edx, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
push str.FtpPasive
push edx
mov dword [ebp - 0x1c], ebx
call edi
test eax, eax
je 0x452721
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push ebx
push str.FtpPasive
push ecx
call esi
mov al, byte [ebp - 0x35]
test al, al
je 0x452732
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
lea ecx, [ebp - 0x78]
call fcn.00524830
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0xb
call fcn.00524830
mov eax, dword [0x6cdb00]
mov byte [ebp - 4], 0xc
cmp eax, ebx
push ebx
jne 0x4528fd
mov edx, dword [0x6fcacc]
mov ecx, dword [0x6fd75c]
lea eax, [ebp - 0x14]
push eax
push ebx
neg edx
push 0xf003f
push ebx
sbb edx, edx
push ebx
push ebx
add edx, 0x80000002
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x68], eax
jne 0x452a0f
mov eax, dword [0x6f7b78]
mov dword [ebp - 0x18], eax
mov eax, dword [0x6fcacc]
mov byte [ebp - 4], 0xd
cmp eax, ebx
mov eax, str.CURRENT_USER
jne 0x4527b3
mov eax, str.MACHINE
mov ecx, dword [0x6fd75c]
lea edx, [ebp - 0x18]
push ecx
push eax
push 0x6c9ce8
push edx
call fcn.0061fae1
mov eax, dword [ebp - 0x18]
add esp, 0x10
lea ecx, [ebp - 0x78]
push eax
call fcn.005248e0
cmp eax, ebx
je 0x452813
mov eax, dword [0x6fcacc]
mov edx, dword [0x6fd75c]
lea ecx, [ebp - 0x14]
push ebx
push ecx
push ebx
neg eax
push 0xf003f
push ebx
sbb eax, eax
push ebx
push ebx
add eax, 0x80000002
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x4528f1
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x78]
call fcn.005249b0
cmp eax, ebx
je 0x452866
mov ecx, dword [0x6fcacc]
mov eax, dword [0x6fd75c]
lea edx, [ebp - 0x14]
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push ebx
push 0xf003f
neg ecx
push ebx
push ebx
sbb ecx, ecx
push ebx
add ecx, 0x80000002
push eax
push ecx
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x4528f1
jmp 0x45286c
mov esi, eax
jmp 0x452612
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [ebp - 0x14]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
push 0x80000001
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x4528f1
mov eax, dword [0x6f7b78]
mov dword [ebp - 0x28], eax
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
lea ecx, [ebp - 0x28]
push str.CURRENT_USER_s
push ecx
mov byte [ebp - 4], 0xe
call fcn.0061fae1
mov edx, dword [ebp - 0x28]
add esp, 0xc
lea ecx, [ebp - 0x8c]
push edx
call fcn.005248e0
cmp eax, ebx
je 0x4528e5
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
push 0x80000001
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xd
call fcn.00622d8a
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x18]
jmp 0x452a02
lea ecx, [ebp - 0x14]
mov edx, dword [0x6fd758]
push ecx
mov cl, byte [0x6fcae8]
xor eax, eax
push ebx
test cl, cl
push 0xf003f
push ebx
setne al
push ebx
push ebx
add eax, 0x80000001
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x452a0f
mov ecx, dword [0x6f7b78]
mov dword [ebp - 0x18], ecx
mov al, byte [0x6fcae8]
mov byte [ebp - 4], 0xf
test al, al
mov eax, str.MACHINE
jne 0x452957
mov eax, str.CURRENT_USER
mov edx, dword [0x6fd758]
push edx
push eax
lea eax, [ebp - 0x18]
push 0x6c9ce8
push eax
call fcn.0061fae1
mov ecx, dword [ebp - 0x18]
add esp, 0x10
push ecx
lea ecx, [ebp - 0x78]
call fcn.005248e0
cmp eax, ebx
je 0x4529b6
mov eax, dword [0x6fd758]
lea edx, [ebp - 0x14]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
mov al, byte [0x6fcae8]
xor ecx, ecx
test al, al
setne cl
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x4529fb
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x78]
push edx
call fcn.005249b0
cmp eax, ebx
je 0x4529fb
lea eax, [ebp - 0x14]
mov ecx, dword [0x6fd758]
push ebx
push eax
mov al, byte [0x6fcae8]
xor edx, edx
push ebx
push 0xf003f
test al, al
push ebx
push ebx
setne dl
push ebx
add edx, 0x80000001
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x18]
call fcn.00622d8a
cmp esi, ebx
je 0x452cee
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push ebx
push ebx
push ebx
push str.MData
push eax
call esi
cmp eax, ebx
je 0x452cee
lea ecx, [ebp - 0x68]
push ecx
call fcn.0060b449
lea edx, [ebp - 0x68]
push edx
call fcn.0060bdd3
mov eax, dword [eax + 0x1c]
add esp, 8
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x64]
push ecx
push edx
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x14]
push ebx
push ebx
mov edi, 4
push str.Model
push eax
mov dword [ebp - 0x3c], edi
call esi
test eax, eax
je 0x452a84
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x60]
lea edx, [ebp - 0x60]
push edi
push edx
push edi
push ebx
push str.Model
push eax
mov dword [ebp - 0x64], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x18]
push ecx
push edx
push ebx
push ebx
push str.Therad
push eax
mov dword [ebp - 0x3c], edi
call esi
test eax, eax
je 0x452b3b
mov eax, dword [0x6cdb00]
mov dword [ebp - 0x18], 1
cmp eax, ebx
je 0x452b0f
lea ecx, [ebp - 0x44]
push ecx
push 1
push ebx
push str.SoftwareClassesCLSID84797876_C678_1780_A556_0CD06786780F
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x452b0f
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x28]
push edx
push eax
push ebx
push ebx
push str.Therad
push ecx
mov dword [ebp - 0x3c], edi
call esi
test eax, eax
jne 0x452b05
mov eax, dword [ebp - 0x28]
cmp eax, 0x1e
jbe 0x452b32
add eax, 0xffffffe2
cmp eax, 0x1a
mov dword [ebp - 0x18], eax
jbe 0x452b05
mov dword [ebp - 0x18], 0x1a
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push ebx
push str.Therad
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x452f19
jmp 0x452cee
mov dword [ebp - 0x18], 1
jmp 0x452b05
mov edx, dword [ebp - 0x18]
mov eax, dword [0x6cdb04]
cmp edx, eax
jae 0x452bb1
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
cmp eax, ecx
je 0x452f19
jbe 0x452b65
sub eax, ecx
cmp eax, 0x14
jbe 0x452b6a
mov eax, 0x14
jmp 0x452b6a
mov eax, 1
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
add esi, eax
lea eax, [ebp - 0x18]
push 4
push eax
push 4
push 0
mov dword [ebp - 0x18], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.Therad
push ecx
call esi
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x60]
push 4
push edx
push 4
push 0
push str.Model
push eax
call esi
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x452cee
cmp dword [0x6cdb00], ebx
jne 0x452e5c
lea ecx, [ebp - 0x20]
push ecx
push 1
push 0
push 0x6c9034
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, 0x32
jne 0x452d2b
mov ecx, dword [0x6fd4a4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x140]
push edx
mov edx, dword [ebp - 0x20]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x24], esi
call edi
test eax, eax
jne 0x452d2b
mov edx, dword [0x6fd4a0]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0x20]
push ecx
push 0
push 0
push edx
push eax
mov dword [ebp - 0x24], esi
call edi
test eax, eax
jne 0x452d2b
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x174]
push ecx
mov ecx, dword [ebp - 0x20]
push edx
push eax
push eax
mov eax, dword [0x6fd49c]
push eax
push ecx
mov dword [ebp - 0x24], esi
call edi
test eax, eax
jne 0x452d2b
mov ecx, dword [0x6fd4a8]
lea edx, [ebp - 0x24]
lea eax, [ebp - 0xc4]
push edx
mov edx, dword [ebp - 0x20]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x24], esi
call edi
test eax, eax
jne 0x452d2b
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [ebp - 0x140]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x452d2b
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x452d2b
lea edi, [ebp - 0x174]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x452d2b
lea edi, [ebp - 0xc4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov bl, 0x2d
cmp ecx, 0x17
jne 0x452d2d
cmp byte [ebp - 0xbf], bl
jne 0x452d2d
cmp byte [ebp - 0xb9], bl
jne 0x452d2d
cmp byte [ebp - 0xb3], bl
jne 0x452d2d
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0xb
call fcn.00524870
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 7
call fcn.00524870
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, 0x2d
lea ecx, [ebp - 0x20]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareDownloadManager_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x452e5c
mov ecx, dword [0x6fd4a4]
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x140]
push edx
mov edx, dword [ebp - 0x20]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x452e5c
mov edx, dword [0x6fd4a0]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0x20]
push ecx
push 0
push 0
push edx
push eax
mov dword [ebp - 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x452e5c
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x174]
push ecx
mov ecx, dword [ebp - 0x20]
push edx
push eax
push eax
mov eax, dword [0x6fd49c]
push eax
push ecx
mov dword [ebp - 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x452e5c
mov ecx, dword [0x6fd4a8]
lea edx, [ebp - 0x24]
lea eax, [ebp - 0xc4]
push edx
mov edx, dword [ebp - 0x20]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x452e5c
lea edi, [ebp - 0x140]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x452e5c
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x452e5c
lea edi, [ebp - 0x174]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x452e5c
lea edi, [ebp - 0xc4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x17
jne 0x452e5c
cmp byte [ebp - 0xbf], bl
jne 0x452e5c
cmp byte [ebp - 0xb9], bl
jne 0x452e5c
cmp byte [ebp - 0xb3], bl
je 0x452cee
lea ecx, [ebp - 0xa14]
call fcn.00524d40
mov edi, dword [0x6fd3a4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 4], 0x10
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [0x6fdfd0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [ebp - 0x2b4]
push 0x100
push ecx
lea ecx, [ebp - 0x50c]
call fcn.00451890
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x2b4]
push 0x100
push edx
push 0
push 0
push str.MData
push eax
mov byte [ebp - 0x1b5], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
lea ecx, [ebp - 0x78]
call fcn.00524b40
lea ecx, [ebp - 0x8c]
call fcn.00524b40
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x452cee