Function at 0x4157e0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x69c
mov eax, dword [0x43239c]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x415e90
cmp dword [ebp + 0xc], 0x35e
jne 0x415e90
push 0x104
push 0x4323d0
lea eax, [esp + 0x5a8]
push eax
call dword [0x4251a0]
push 0x104
lea ecx, [esp + 0x5a4]
push str.RfwCfg.dat
push ecx
mov dword [esp + 0x1c], edi
call dword [0x4253d8]
mov ecx, dword [0x4323a0]
mov edx, dword [ecx]
add esp, 0xc
push 0x100
push 1
lea eax, [esp + 0x5a8]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
call dword [edx + 0xc]
cmp eax, edi
mov ebx, dword [ebp + 8]
mov dword [esp + 0x1c], eax
jne 0x4158cc
mov eax, dword [esp + 0x18]
mov ecx, dword [0x4323a0]
push edi
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edi
mov edx, dword [ecx]
push eax
call dword [edx + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x4323a0]
mov edx, dword [ecx]
push 1
push 1
push edi
cmp eax, edi
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push ebx
push eax
jne 0x4158b5
call dword [edx + 0x20]
jmp 0x4158b8
call dword [edx + 0x1c]
mov ecx, dword [0x4323a0]
mov edx, dword [ecx]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
push eax
call dword [edx + 0x10]
mov ecx, dword [0x43239c]
mov edx, dword [ecx]
lea eax, [esp + 0x240]
push eax
call dword [edx + 0x34]
cmp dword [0x42e0e4], 2
jne 0x4158f8
mov al, byte [ebx]
or al, 2
mov dword [ebx + 0x332], 1
mov byte [ebx], al
mov ecx, dword [0x43239c]
mov edx, dword [ecx]
push ebx
call dword [edx + 0x30]
mov al, byte [ebx]
mov cl, byte [esp + 0x240]
and al, 1
and cl, 1
cmp al, cl
je 0x415be1
cmp dword [0x4316b8], 8
mov esi, dword [0x42506c]
mov dword [esp + 0xc], edi
jge 0x4159f4
test al, al
je 0x415967
lea edx, [esp + 0xc]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x425060]
test eax, eax
jne 0x415b01
mov eax, dword [esp + 0xc]
push str.rfwservice
push eax
call dword [0x425064]
jmp 0x415b01
mov byte [esp + 0x38], 0x22
mov byte [esp + 0x39], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x3a]
rep stosd dword es:[edi], eax
push 0x208
lea ecx, [esp + 0x3d]
push ecx
push 0
stosw word es:[edi], ax
call dword [0x4251c4]
lea edx, [esp + 0x39]
push 0x5c
push edx
call dword [0x4253dc]
push 0x208
mov byte [eax + 1], 0
lea eax, [esp + 0x44]
push str.rfwsrv.exe___service
push eax
call dword [0x4253d8]
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x425068]
lea eax, [esp + 0x38]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4159d7
sub eax, edi
push eax
lea edx, [esp + 0x3c]
push edx
push 1
push 0
push str.rfwservice
jmp 0x415afa
mov edi, dword [0x425060]
lea ecx, [esp + 0xc]
push ecx
push str.SYSTEMCurrentControlSetServices_rfwservice
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x415b10
mov ecx, dword [esp + 0xc]
xor edx, edx
mov dl, byte [ebx]
push 4
lea eax, [esp + 0x34]
push eax
push 4
push 0
push str.Start
and edx, 1
or edx, 2
push ecx
mov dword [esp + 0x48], edx
call esi
cmp dword [0x4316b8], 9
jne 0x415a9f
test byte [ebx], 1
je 0x415a58
mov edx, dword [esp + 0xc]
push str.Group
push edx
call dword [0x425064]
jmp 0x415a9f
xor eax, eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x494454
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415a80
sub eax, edx
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x24]
push ecx
push 1
push 0
push str.Group
push edx
call esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x415ab6
push eax
call dword [0x42503c]
mov dword [esp + 0xc], 0
cmp dword [0x4316b8], 9
jle 0x415b10
mov eax, dword [0x42f398]
test eax, eax
jne 0x415b10
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesRfwProxySrv
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x415b01
xor ecx, ecx
mov cl, byte [ebx]
push 4
lea edx, [esp + 0x38]
push edx
push 4
push eax
push str.Start
and ecx, 1
or ecx, 2
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x20]
push eax
call esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x415b10
push eax
call dword [0x42503c]
lea ecx, [esp + 0x14]
push ecx
push 0x20006
push 0
push str.softwaremicrosoftwindowsCurrentVersion_run
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
call dword [0x425070]
test eax, eax
je 0x415b44
mov eax, 0xfffffe0c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [ebx], 1
je 0x415b5b
mov edx, dword [esp + 0x14]
push str.RfwMain
push edx
call dword [0x425064]
jmp 0x415bd0
xor eax, eax
mov byte [esp + 0x38], 0x22
mov byte [esp + 0x39], 0
mov ecx, 0x40
lea edi, [esp + 0x3a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x3d]
push eax
push 0
call dword [0x4251c4]
lea ecx, [esp + 0x39]
push 0x5c
push ecx
call dword [0x4253dc]
push 0x104
lea edx, [esp + 0x44]
push str.rfwmain.exe___startup
push edx
mov byte [eax + 1], 0
call dword [0x4253d8]
add esp, 0x14
lea eax, [esp + 0x38]
push eax
call dword [0x42519c]
mov edx, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
push ecx
push 1
push 0
push str.RfwMain
push edx
call esi
mov eax, dword [esp + 0x14]
xor edi, edi
cmp eax, edi
je 0x415be1
push eax
call dword [0x42503c]
mov dl, byte [esp + 0x240]
xor eax, eax
mov al, byte [ebx]
mov cl, al
xor cl, dl
test cl, 0xc
je 0x415c07
mov ecx, dword [0x43239c]
mov edx, dword [ecx]
shr eax, 2
and eax, 3
push eax
call dword [edx + 0x24]
movzx edx, byte [ebx + 2]
mov ecx, dword [0x4323a4]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x14]
push edx
call dword [eax + 0xc]
movzx edx, byte [ebx + 0x17]
mov ecx, dword [0x4323a4]
mov eax, dword [ecx]
shr edx, 7
push edx
lea edx, [esp + 0x14]
push edx
call dword [eax + 0x20]
mov al, byte [ebx + 0x17]
test al, al
jns 0x415c69
mov edx, dword [ebx + 0x32e]
mov ecx, dword [0x4323a4]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x14]
push edx
call dword [eax + 0x18]
mov ecx, dword [0x4323a4]
mov eax, dword [ecx]
lea edx, [ebx + 0x22a]
push edx
lea edx, [esp + 0x14]
push edx
call dword [eax + 0x1c]
push ebx
call fcn.0040ef50
mov al, byte [ebx + 1]
add esp, 4
test al, 0x20
je 0x415e35
lea ecx, [esp + 0xc]
call dword [0x42523c]
mov al, byte [ebx]
mov cl, byte [esp + 0x240]
xor al, cl
test al, 1
je 0x415cac
push str.CFG_OSSTART_
lea ecx, [esp + 0x10]
call dword [0x42526c]
mov cl, byte [esp + 0x240]
mov dl, byte [ebx]
xor dl, cl
test dl, 2
je 0x415ccb
push str.CFG_IPFIRST_
lea ecx, [esp + 0x10]
call dword [0x42526c]
mov cl, byte [esp + 0x240]
mov al, byte [ebx]
mov dl, al
xor dl, cl
test dl, 0x20
jne 0x415cf1
xor al, cl
test al, 0xc0
jne 0x415cf1
mov ecx, 4
lea edi, [esp + 0x247]
lea esi, [ebx + 7]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x415d00
push str.CFG_PASSWORD_
lea ecx, [esp + 0x10]
call dword [0x42526c]
mov cl, byte [ebx + 2]
cmp cl, byte [esp + 0x242]
jne 0x415d4e
mov dl, byte [ebx + 1]
cmp dl, byte [esp + 0x241]
jne 0x415d4e
mov eax, dword [ebx + 0x32e]
cmp eax, dword [esp + 0x56e]
jne 0x415d4e
mov cl, byte [ebx + 0x17]
xor cl, byte [esp + 0x257]
test cl, cl
js 0x415d4e
lea edx, [esp + 0x46a]
push edx
lea eax, [ebx + 0x22a]
push eax
call dword [0x4250c8]
test eax, eax
je 0x415d5d
push str.CFG_LOGTYPE_
lea ecx, [esp + 0x10]
call dword [0x42526c]
mov cl, byte [ebx + 5]
cmp cl, byte [esp + 0x245]
jne 0x415d75
mov dl, byte [ebx + 6]
cmp dl, byte [esp + 0x246]
je 0x415d84
push str.CFG_APPDEF_
lea ecx, [esp + 0x10]
call dword [0x42526c]
mov al, byte [ebx]
xor al, byte [esp + 0x240]
test al, 0xc
je 0x415deb
push str.CFG_SAFELOW_
lea ecx, [esp + 0x24]
call dword [0x425270]
push str.CFG_SAFEMID_
lea ecx, [esp + 0x28]
call dword [0x425270]
push str.CFG_SAFEHIGH_
lea ecx, [esp + 0x2c]
call dword [0x425270]
xor ecx, ecx
mov cl, byte [ebx]
shr ecx, 2
and ecx, 3
lea edx, [esp + ecx*4 + 0x20]
push edx
lea ecx, [esp + 0x10]
call dword [0x425268]
mov eax, dword [0x425210]
push eax
push 3
push 4
lea ecx, [esp + 0x2c]
push ecx
call fcn.004226b7
lea ecx, [esp + 0xc]
call dword [0x42525c]
test al, al
jne 0x415e29
lea ecx, [esp + 0xc]
call dword [0x425220]
push eax
lea ecx, [esp + 0x10]
call dword [0x425220]
push eax
lea ecx, [esp + 0x14]
call dword [0x425264]
push eax
push 0x2bc
lea edx, [esp + 0x1c]
push edx
call fcn.0040e110
lea ecx, [esp + 0xc]
call dword [0x425210]
xor edi, edi
movzx esi, byte [ebx + 4]
push str.SetGloabCfg_if_setlonBmp_n
call fcn.004011d0
movzx eax, byte [esp + 0x248]
add esp, 4
cmp eax, esi
je 0x415e85
test byte [0x42e188], 1
jle 0x415e85
cmp dword [0x4316b8], 9
jl 0x415e85
call fcn.004048f0
cmp dword [eax + 0x3c], edi
jne 0x415e85
push str.SetGloabCfg_must_setlonBmp_n
call fcn.004011d0
add esp, 4
call fcn.0040cce0
call fcn.0040cd60
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xfffffe76
pop ebx
mov esp, ebp
pop ebp
ret