Function at 0x438131
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get installed programs
Query or enumerate registry value
Resolve dns
Send data
Send data on socket
Set registry value

Disassembly:
push 0xa84
mov eax, 0x5c6eb9
call fcn.005870c4
mov esi, ecx
and dword [ebp - 4], 0
lea eax, [ebp - 0x920]
push eax
mov byte [ebp - 0x8f5], 0
call fcn.004084c2
mov byte [ebp - 4], 1
lea ebx, [esi + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x24]
lea edi, [ebp - 0x920]
call fcn.0040857c
mov esi, dword [esi + 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
or ebx, 0xffffffff
mov dword [ebp - 0x94c], edi
cmp edi, ebx
jne 0x4381e2
cmp dword [0x6c438c], 3
jl 0x4381be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.socket_error____i
push 0x684e40
push 3
call fcn.00538922
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x920]
call fcn.00408559
mov dword [ebp - 4], ebx
lea ecx, [ebp + 8]
call fcn.00408559
xor al, al
call fcn.00587147
ret 8
push 2
pop eax
push esi
mov word [ebp - 0x8cc], ax
call dword [sym.imp.WS2_32.dll_htons]
push ecx
mov word [ebp - 0x8ca], ax
mov eax, esp
mov dword [ebp - 0x8fc], esp
lea ecx, [ebp - 0x920]
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 2
lea eax, [ebp - 0x90c]
push eax
mov byte [ebp - 4], 1
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 3
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x8c8], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90c]
call fcn.00408418
cmp dword [ebp - 0x8c8], ebx
jne 0x4382e3
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
lea ecx, [ebp - 0x920]
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 4
lea eax, [ebp - 0x90c]
push eax
mov byte [ebp - 4], 1
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 5
push dword [eax]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90c]
call fcn.00408418
test esi, esi
jne 0x4382ca
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [0x6c438c], 3
jl 0x4381be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.gethostbyname_error____i
push 0x684e74
jmp 0x4381b4
movsx eax, word [esi + 0xa]
push eax
mov eax, dword [esi + 0xc]
push dword [eax]
lea eax, [ebp - 0x8c8]
push eax
call fcn.0057e690
add esp, 0xc
push 0x10
lea eax, [ebp - 0x8cc]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, ebx
jne 0x438327
xor bl, bl
push dword [ebp - 0x94c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x920]
call fcn.00408559
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00408559
mov al, bl
jmp 0x4381da
push 0x684e8c
lea eax, [ebp + 8]
push eax
call fcn.00425f4d
push dword [0x6de968]
lea eax, [ebp + 8]
push eax
call fcn.00425f4d
mov esi, 0x100000
push esi
call fcn.00579e3f
pop ecx
push esi
mov ebx, eax
push 0
push ebx
call fcn.0057e5e0
pop ecx
pop ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 6
lea eax, [ebp - 0x90c]
push eax
mov byte [ebp - 4], 1
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 7
mov eax, dword [eax]
mov edx, ebx
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x43838d
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90c]
call fcn.00408418
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4383ab
sub eax, esi
xor esi, esi
mov edi, eax
mov dword [ebp - 0x908], esi
push 0
push edi
lea eax, [esi + ebx]
push eax
push dword [ebp - 0x94c]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x4383f8
mov byte [ebp - 0x8f5], 1
cmp eax, 0xffffffff
je 0x4383f8
add esi, eax
cmp eax, edi
je 0x4383f8
sub edi, eax
inc dword [ebp - 0x908]
cmp dword [ebp - 0x908], 0xa
jl 0x4383be
push ebx
call fcn.00579d62
xor edi, edi
pop ecx
cmp esi, edi
je 0x439571
cmp byte [ebp + 0xc], 0
je 0x439571
push dword [ebp - 0x94c]
lea eax, [ebp - 0x924]
push eax
call fcn.00437f47
mov byte [ebp - 4], 8
xor ebx, ebx
inc ebx
cmp dword [0x6c438c], ebx
jl 0x43848e
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
lea ecx, [ebp - 0x924]
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 9
lea eax, [ebp - 0x90c]
push eax
mov byte [ebp - 4], 8
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
mov esi, eax
call fcn.004084ab
push eax
push str.Receive_data:__s
push 0x684ea4
push ebx
call fcn.00538922
add esp, 0x10
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x90c]
call fcn.00408418
mov eax, dword [ebp - 0x924]
cmp dword [eax - 0xc], edi
jle 0x439562
push str.set_keywords:
xor ecx, ecx
lea esi, [ebp - 0x924]
call fcn.004260a9
test eax, eax
jne 0x438825
mov eax, esi
push eax
lea eax, [ebp - 0x900]
push eax
call fcn.004084e9
mov byte [ebp - 4], 0xb
push 0x684ed8
xor ecx, ecx
lea esi, [ebp - 0x900]
call fcn.004260a9
inc eax
mov ecx, esi
call fcn.00425efc
lea eax, [ebp - 0xa74]
push eax
call fcn.0043400a
mov byte [ebp - 4], 0xc
push ecx
mov esi, esp
mov dword [ebp - 0x8fc], esp
push ecx
mov eax, esp
mov dword [ebp - 0x90c], esp
lea ecx, [ebp - 0x900]
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 0xd
push esi
mov byte [ebp - 4], 0xc
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0xa74]
push eax
mov byte [ebp - 4], 0xc
call fcn.004340cf
call fcn.00431149
mov ebx, eax
cmp ebx, edi
je 0x4387c0
mov eax, dword [ebx]
lea ecx, [ebp - 0xa74]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov eax, dword [ebp - 0x9f4]
mov eax, dword [eax]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0xa0c]
lea edi, [ebp - 0x910]
lea esi, [ebp - 0x91c]
mov dword [ebp - 0x910], eax
call fcn.00469749
test al, al
jne 0x438625
push 0xa7
mov byte [ebp - 0xbc], al
lea eax, [ebp - 0xbb]
push 0
push eax
call fcn.0057e5e0
add esp, 0xc
lea eax, [ebp - 0xbc]
push eax
call fcn.00450172
push ecx
add eax, 4
mov ecx, esp
mov dword [ebp - 0x8fc], esp
push eax
push ecx
call fcn.0040fca9
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0xc
call fcn.00420e36
pop ecx
pop ecx
push 0xa8
lea eax, [ebp - 0xbc]
push eax
call fcn.00450172
push ecx
mov ecx, esp
mov dword [ebp - 0x8fc], esp
push eax
push ecx
call fcn.0040fca9
mov byte [ebp - 4], 0x10
mov eax, dword [ebx]
add eax, 0xc
mov byte [ebp - 4], 0xc
mov ecx, ebx
call dword [eax]
call fcn.004302bd
jmp 0x43856e
lea eax, [ebp - 0x8ec]
push eax
call fcn.0040f899
mov byte [ebp - 4], 0x11
push 0
lea ecx, [ebp - 0x8ec]
call fcn.00410181
test al, al
je 0x4387b0
lea eax, [ebp - 0x8ec]
push eax
call fcn.0041187e
mov eax, dword [ebp - 0xa64]
sub eax, dword [ebp - 0xa68]
mov ecx, 0x218
cdq
idiv ecx
and dword [ebp - 0x8f0], 0
test eax, eax
jbe 0x4386c4
push dword [ebp - 0x8f0]
lea esi, [ebp - 0xa74]
call fcn.0043b93a
sub esp, 0x218
mov esi, eax
mov edi, esp
mov ecx, 0x86
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x8ec]
call fcn.004117cf
mov eax, dword [ebp - 0xa64]
sub eax, dword [ebp - 0xa68]
mov ecx, 0x218
cdq
idiv ecx
inc dword [ebp - 0x8f0]
cmp dword [ebp - 0x8f0], eax
jb 0x438675
mov eax, dword [ebp - 0xa14]
mov eax, dword [eax]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0xa14]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0xa2c]
lea edi, [ebp - 0x910]
lea esi, [ebp - 0x91c]
mov dword [ebp - 0x910], eax
call fcn.00469749
test al, al
jne 0x438742
call fcn.00450172
movzx eax, byte [eax + 4]
push eax
call fcn.00450172
push ecx
mov ecx, esp
mov dword [ebp - 0x8fc], esp
push eax
push ecx
call fcn.0040fca9
mov byte [ebp - 4], 0x12
mov eax, dword [ebx]
add eax, 0x10
mov byte [ebp - 4], 0x11
mov ecx, ebx
call dword [eax]
call fcn.004302bd
jmp 0x4386de
push dword [ebp - 0x9dc]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0x6c83e4
call esi
push dword [ebp - 0x9dc]
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
push 0x684edc
push eax
call fcn.00408518
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x11
call fcn.0042d5aa
push dword [ebp - 0x9d8]
push 0x6c83e8
call esi
push dword [ebp - 0x9d8]
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
push str.ShowBandwidth100p
push eax
call fcn.00408518
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x11
call fcn.0042d5aa
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x8ec]
push eax
call fcn.0040f8c5
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0xa0c]
push eax
call fcn.0042e076
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0xa2c]
push eax
call fcn.00434bb6
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0xa44]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0xa5c]
push eax
call fcn.0043d638
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xa74]
push eax
call fcn.0043d638
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x900]
call fcn.00408559
jmp 0x439562
lea eax, [ebp - 0x988]
push eax
call fcn.00448527
mov byte [ebp - 4], 0x1a
lea esi, [ebp - 0x924]
call fcn.00408793
push eax
lea esi, [ebp - 0x9d4]
call fcn.00408172
mov byte [ebp - 4], 0x1b
push 0x3b
lea edx, [ebp - 0x988]
mov ecx, esi
call fcn.0041d23e
pop ecx
mov byte [ebp - 4], 0x1a
push edi
push ebx
call fcn.00409bf1
mov eax, dword [ebp - 0x978]
sub eax, dword [ebp - 0x97c]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x908], edi
test eax, eax
jbe 0x439552
push dword [ebp - 0x908]
lea esi, [ebp - 0x988]
call fcn.00448491
cmp dword [eax + 0x18], 8
jb 0x4388a7
mov eax, dword [eax + 4]
jmp 0x4388aa
add eax, 4
push eax
lea eax, [ebp - 0x8f0]
push eax
call fcn.00408518
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x8f0]
cmp dword [eax - 0xc], edi
je 0x43951f
push str.Quick_Scan
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x438914
call fcn.004571f2
push edi
push edi
push ebx
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x8f4], esp
push 0x684f3c
push eax
call fcn.0040f93f
mov byte [ebp - 4], 0x1d
push esi
mov byte [ebp - 4], 0x1c
call fcn.00460ed9
push eax
mov ecx, esi
call fcn.00468590
push str.Full_Scan
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x43895e
call fcn.004571f2
push edi
push edi
push ebx
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x8f4], esp
push str.Full
push eax
call fcn.0040f93f
mov byte [ebp - 4], 0x1e
push esi
mov byte [ebp - 4], 0x1c
call fcn.00460ed9
push eax
mov ecx, esi
call fcn.00468590
push str.Custom_Scan
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x4389e6
mov eax, esi
push eax
lea eax, [ebp - 0x900]
push eax
call fcn.004084e9
mov byte [ebp - 4], 0x1f
push 0x684f78
xor ecx, ecx
lea esi, [ebp - 0x900]
call fcn.004260a9
inc eax
mov ecx, esi
call fcn.00425efc
call fcn.004571f2
push edi
push edi
push ebx
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x8f4], esp
lea ecx, [ebp - 0x900]
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 0x20
push esi
mov byte [ebp - 4], 0x1f
call fcn.00460ed9
push eax
mov ecx, esi
call fcn.00468590
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x900]
call fcn.00408559
push 0x684f7c
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x438a18
call fcn.004571f2
push edi
call fcn.00464537
mov ecx, dword [0x6de43c]
add ecx, 0xc0
call fcn.0046f6e8
push str.Device_Block
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x438a4a
call fcn.004571f2
push ebx
call fcn.00464537
mov ecx, dword [0x6de43c]
add ecx, 0xc0
call fcn.0046f6e8
push str.fw_enable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x438a71
call fcn.00431149
cmp eax, edi
je 0x438a71
mov edx, dword [eax]
push ebx
mov ecx, eax
call dword [edx + 4]
push str.fw_disable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x438a98
call fcn.00431149
cmp eax, edi
je 0x438a98
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 4]
push str.ssl_enable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x438ae6
push ebx
push 0x6c8404
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push dword [0x6c8404]
push ecx
mov eax, esp
mov dword [ebp - 0x8f4], esp
push 0x684ff8
push eax
call fcn.00408518
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x1c
call fcn.0042d5aa
call fcn.004315de
push str.ssl_disable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x438b34
push edi
push 0x6c8404
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push dword [0x6c8404]
push ecx
mov eax, esp
mov dword [ebp - 0x8f4], esp
push str.EnableSSL
push eax
call fcn.00408518
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x1c
call fcn.0042d5aa
call fcn.004315de
push str.USB_Protection:
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x438eda
lea eax, [ebp - 0x9a0]
push eax
call fcn.00413a77
mov byte [ebp - 4], 0x23
or dword [ebp - 0x8f4], 0xffffffff
or dword [ebp - 0x914], 0xffffffff
or dword [ebp - 0x930], 0xffffffff
mov eax, esi
push eax
lea eax, [ebp - 0x954]
push eax
call fcn.004084e9
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x9b8]
push eax
call fcn.00448527
mov byte [ebp - 4], 0x25
lea esi, [ebp - 0x954]
call fcn.00408793
push eax
lea esi, [ebp - 0xa90]
call fcn.00408172
mov byte [ebp - 4], 0x26
push 0xd
lea edx, [ebp - 0x9b8]
mov ecx, esi
call fcn.0041d23e
pop ecx
mov byte [ebp - 4], 0x25
push edi
push ebx
call fcn.00409bf1
mov eax, dword [ebp - 0x9a8]
sub eax, dword [ebp - 0x9ac]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x904], edi
test eax, eax
jbe 0x438e67
push dword [ebp - 0x904]
lea esi, [ebp - 0x9b8]
call fcn.00448491
cmp dword [eax + 0x18], 8
jb 0x438c08
mov eax, dword [eax + 4]
jmp 0x438c0b
add eax, 4
push eax
lea eax, [ebp - 0x948]
push eax
call fcn.00408518
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x948]
call fcn.0042613d
lea eax, [ebp - 0x970]
push eax
call fcn.00448527
mov byte [ebp - 4], 0x28
lea esi, [ebp - 0x948]
call fcn.00408793
push eax
lea esi, [ebp - 0x8e8]
call fcn.00408172
mov byte [ebp - 4], 0x29
push 0x3a
lea edx, [ebp - 0x970]
mov ecx, esi
call fcn.0041d23e
pop ecx
mov byte [ebp - 4], 0x28
push edi
push ebx
call fcn.00409bf1
mov eax, dword [ebp - 0x960]
sub eax, dword [ebp - 0x964]
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, 2
jne 0x438ddf
push str.USB_Protection
push edi
lea esi, [ebp - 0x970]
call fcn.00448491
call fcn.0041b179
pop ecx
test al, al
je 0x438cc4
push ebx
call fcn.00448491
cmp dword [eax + 0x18], 8
jb 0x438cb4
mov eax, dword [eax + 4]
jmp 0x438cb7
add eax, 4
push eax
call fcn.00579d57
pop ecx
mov dword [ebp - 0x8f4], eax
push str.delay
push edi
lea esi, [ebp - 0x970]
call fcn.00448491
call fcn.0041b179
pop ecx
test al, al
je 0x438d00
push ebx
call fcn.00448491
cmp dword [eax + 0x18], 8
jb 0x438cf0
mov eax, dword [eax + 4]
jmp 0x438cf3
add eax, 4
push eax
call fcn.00579d57
pop ecx
mov dword [ebp - 0x914], eax
push str.password
push edi
lea esi, [ebp - 0x970]
call fcn.00448491
call fcn.0041b179
pop ecx
test al, al
je 0x438d2c
push ebx
call fcn.00448491
call fcn.004380f3
mov dword [ebp - 0x930], eax
push str.excluded
push edi
lea esi, [ebp - 0x970]
call fcn.00448491
call fcn.0041b179
pop ecx
test al, al
je 0x438ddf
push 0x6850ac
lea eax, [ebp - 0x958]
push eax
call fcn.00408518
mov byte [ebp - 4], 0x2a
push ebx
call fcn.00448491
cmp dword [eax + 0x18], 8
jb 0x438d71
mov eax, dword [eax + 4]
jmp 0x438d74
add eax, 4
push eax
lea eax, [ebp - 0x950]
push eax
call fcn.00408518
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x958]
push eax
push 0x2c
lea ecx, [ebp - 0x950]
lea edi, [ebp - 0x9d0]
call fcn.00474fa0
pop ecx
pop ecx
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x9a0]
call fcn.0043b98d
mov byte [ebp - 4], 0x2b
mov eax, edi
push eax
call fcn.00413aaf
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x950]
call fcn.00408559
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x958]
call fcn.00408559
xor ebx, ebx
inc ebx
xor edi, edi
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x970]
push eax
call fcn.0043bfcc
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x948]
call fcn.00408559
mov eax, dword [ebp - 0x9a8]
sub eax, dword [ebp - 0x9ac]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x904]
cmp dword [ebp - 0x904], eax
jb 0x438bec
cmp dword [ebp - 0x930], 0xffffffff
je 0x438e3c
call fcn.004571f2
push dword [ebp - 0x930]
push eax
call fcn.00465bc0
cmp dword [ebp - 0x8f4], 0xffffffff
je 0x438e67
cmp dword [ebp - 0x914], 0xffffffff
je 0x438e67
call fcn.004571f2
push dword [ebp - 0x914]
mov ecx, eax
push dword [ebp - 0x8f4]
push ebx
call fcn.004656c8
call fcn.004571f2
mov ebx, eax
mov eax, dword [ebp - 0x990]
sub eax, dword [ebp - 0x994]
sar eax, 2
test eax, eax
jbe 0x438ea6
lea esi, [ebp - 0x9a0]
call fcn.00413f62
push eax
call fcn.004658bc
mov eax, dword [ebp - 0x990]
sub eax, dword [ebp - 0x994]
inc edi
sar eax, 2
cmp edi, eax
jb 0x438e81
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x9b8]
push eax
call fcn.0043bfcc
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x954]
call fcn.00408559
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x9a0]
push eax
call fcn.00413aaf
xor ebx, ebx
xor edi, edi
inc ebx
push 0x6850b0
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x438f5b
mov eax, esi
push eax
lea eax, [ebp - 0x934]
push eax
call fcn.004084e9
mov byte [ebp - 4], 0x2d
push 0x6850d0
xor ecx, ecx
lea esi, [ebp - 0x934]
call fcn.004260a9
inc eax
mov ecx, esi
call fcn.00425efc
push ecx
mov eax, esp
mov dword [ebp - 0x8f4], esp
mov ecx, esi
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0x2d
call fcn.0041cbae
pop ecx
mov esi, eax
call fcn.004571f2
push esi
mov ecx, eax
call fcn.004657f5
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x934]
call fcn.00408559
push 0x6850d4
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x438fdc
mov eax, esi
push eax
lea eax, [ebp - 0x93c]
push eax
call fcn.004084e9
mov byte [ebp - 4], 0x2f
push 0x6850f8
xor ecx, ecx
lea esi, [ebp - 0x93c]
call fcn.004260a9
inc eax
mov ecx, esi
call fcn.00425efc
push ecx
mov eax, esp
mov dword [ebp - 0x8f4], esp
mov ecx, esi
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x2f
call fcn.0041cbae
pop ecx
mov esi, eax
call fcn.004571f2
push esi
mov ecx, eax
call fcn.00465a42
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x93c]
call fcn.00408559
push 0x6850fc
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
je 0x439036
push str.opt_scan
xor ecx, ecx
call fcn.004260a9
test eax, eax
je 0x439036
push str.opt_update
xor ecx, ecx
call fcn.004260a9
test eax, eax
je 0x439036
push str.opt_sch
xor ecx, ecx
call fcn.004260a9
test eax, eax
je 0x439036
push str.opt_logs
xor ecx, ecx
call fcn.004260a9
test eax, eax
jne 0x4392d2
lea eax, [ebp - 0x8f0]
push eax
lea eax, [ebp - 0x938]
push eax
call fcn.004084e9
mov byte [ebp - 4], 0x31
push 0x685160
xor ecx, ecx
lea esi, [ebp - 0x938]
call fcn.004260a9
inc eax
mov ecx, esi
call fcn.00425efc
mov eax, esi
push eax
call fcn.00404131
mov eax, dword [0x6de8a0]
sub eax, dword [0x6de89c]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x4392c3
mov ecx, dword [0x6de43c]
add ecx, 0xc0
call fcn.0046f612
call fcn.00401cbc
mov eax, dword [0x6de8a0]
sub eax, dword [0x6de89c]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x904], edi
cmp eax, edi
jbe 0x43929c
and dword [ebp - 0x8f4], 0
cmp edi, eax
jb 0x4390cd
call fcn.0057a4ca
mov eax, dword [0x6de89c]
mov ecx, dword [ebp - 0x8f4]
lea edi, [eax + ecx]
mov eax, dword [edi]
test eax, eax
jne 0x4390f8
movzx edx, byte [edi + 0xc]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00401924
jmp 0x439272
cmp eax, 1
jne 0x439112
push dword [edi + 0x10]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
call fcn.00401793
jmp 0x439272
cmp eax, 2
jne 0x439143
push ecx
lea eax, [edi + 0x14]
mov ecx, esp
mov dword [ebp - 0x914], esp
push eax
call fcn.0040102d
mov byte [ebp - 4], 0x32
mov eax, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push edi
mov byte [ebp - 4], 0x31
call fcn.00401aba
jmp 0x439272
cmp eax, 3
jne 0x439272
push 0x685164
lea ebx, [edi + 4]
push ebx
call fcn.004170b5
test eax, eax
jne 0x43922f
lea eax, [edi + 8]
push 0x685170
push eax
mov dword [ebp - 0x914], eax
call fcn.004170b5
test eax, eax
jne 0x43922f
push ecx
mov ecx, esp
mov dword [ebp - 0x930], esp
call fcn.004010c4
mov byte [ebp - 4], 0x33
push ecx
mov dword [ebp - 0x918], esp
mov esi, esp
push 0xffffffffffffffff
push str.RealtimeNew
call fcn.004c1c50
pop ecx
pop ecx
mov dword [esi], eax
mov byte [ebp - 4], 0x34
push 0x685188
lea eax, [ebp - 0x940]
push eax
mov byte [ebp - 4], 0x31
call fcn.004012f8
mov byte [ebp - 4], 0x35
add edi, 0x18
push edi
lea ecx, [ebp - 0x940]
call fcn.0043c3fd
push ecx
lea eax, [ebp - 0x940]
mov ecx, esp
mov dword [ebp - 0x918], esp
push eax
call fcn.004010ed
mov byte [ebp - 4], 0x36
mov esi, dword [ebp - 0x914]
call fcn.004084ab
push ecx
mov dword [ebp - 0x914], esp
mov esi, esp
push 0xffffffffffffffff
push eax
call fcn.004c1c50
pop ecx
pop ecx
mov dword [esi], eax
mov byte [ebp - 4], 0x37
mov ebx, dword [ebx]
push ebx
mov byte [ebp - 4], 0x35
call fcn.004015ae
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x940]
call fcn.00401113
jmp 0x439272
push ecx
lea eax, [edi + 0x18]
mov ecx, esp
mov dword [ebp - 0x918], esp
push eax
call fcn.004010ed
mov byte [ebp - 4], 0x38
lea esi, [edi + 8]
call fcn.004084ab
push ecx
mov dword [ebp - 0x914], esp
mov esi, esp
push 0xffffffffffffffff
push eax
call fcn.004c1c50
pop ecx
pop ecx
mov dword [esi], eax
mov byte [ebp - 4], 0x39
mov ebx, dword [ebx]
push ebx
mov byte [ebp - 4], 0x31
call fcn.004015ae
mov eax, dword [0x6de8a0]
sub eax, dword [0x6de89c]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x904]
add dword [ebp - 0x8f4], 0x1c
cmp dword [ebp - 0x904], eax
jb 0x4390cd
call fcn.00401cbc
mov ecx, dword [0x6de43c]
add ecx, 0xc0
call fcn.0046f612
call fcn.004571f2
mov ecx, eax
call fcn.00460fb5
xor ebx, ebx
xor edi, edi
inc ebx
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x938]
call fcn.00408559
push str.opt_pass
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x4393da
mov eax, esi
push eax
lea eax, [ebp - 0x92c]
push eax
call fcn.004084e9
mov byte [ebp - 4], 0x3a
push 0x6851a8
xor ecx, ecx
lea esi, [ebp - 0x92c]
call fcn.004260a9
inc eax
mov ecx, esi
call fcn.00425efc
mov ecx, dword [0x6de43c]
add ecx, 0xc0
call fcn.0046f612
call fcn.00401cbc
push ebx
push 0x6851ac
push 0x6851b4
call fcn.00401924
push dword [ebp - 0x92c]
call fcn.00579d57
pop ecx
push eax
push str.Password
push 0x6851c8
mov dword [ebp - 0x8fc], eax
call fcn.00401793
push dword [0x6de664]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp eax, edi
je 0x4393b5
lea eax, [ebp - 0x944]
push eax
push 2
mov dword [ebp - 0x944], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
cmp dword [ebp - 0x944], edi
je 0x4393af
push 4
lea eax, [ebp - 0x8fc]
push eax
push 4
push str.SP01
push str.SoftwareMicrosoftShared
push dword [ebp - 0x944]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
call fcn.00401cbc
mov ecx, dword [0x6de43c]
add ecx, 0xc0
call fcn.0046f612
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x92c]
call fcn.00408559
push str.Download_Updates
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x439402
call fcn.004571f2
push edi
mov ebx, eax
call fcn.00460e82
xor ebx, ebx
inc ebx
xor edi, edi
push str.Uninstall_Client
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.004260a9
test eax, eax
jne 0x43951f
cmp dword [0x6de664], edi
je 0x439502
lea eax, [ebp - 0x928]
push eax
call fcn.004084c2
mov byte [ebp - 4], 0x3b
push dword [0x6de664]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x8bc]
push eax
push edi
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallVibranium_Threat_Security_is1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x90c], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43949b
mov eax, dword [ebp - 0x90c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x8bc], cx
lea eax, [ebp - 0x8bc]
push eax
lea eax, [ebp - 0x928]
push eax
call fcn.004085bd
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x928]
cmp dword [eax - 0xc], edi
je 0x4394f1
mov esi, dword [0x6de664]
push ecx
mov eax, esp
mov dword [ebp - 0x918], esp
push str._VERYSILENT
push eax
call fcn.00408518
mov byte [ebp - 4], 0x3c
push ecx
mov eax, esp
mov dword [ebp - 0x8f4], esp
lea ecx, [ebp - 0x928]
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x3b
mov ecx, esi
call fcn.00437ffd
pop ecx
pop ecx
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x928]
call fcn.00408559
jmp 0x43951f
cmp dword [0x6c438c], 3
jl 0x43951f
push str.User_token_is_not_available
push str.Reporter::SendReport
push 3
call fcn.00538922
add esp, 0xc
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x8f0]
call fcn.00408559
mov eax, dword [ebp - 0x978]
sub eax, dword [ebp - 0x97c]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x908]
cmp dword [ebp - 0x908], eax
jb 0x43888b
mov byte [ebp - 4], 8
lea eax, [ebp - 0x988]
push eax
call fcn.0043bfcc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x924]
call fcn.00408559
mov bl, byte [ebp - 0x8f5]
jmp 0x4382f9