Function at 0x4aec93
Capabilities:
Create process on windows
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512a0e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x137c
call fcn.005106b0
lea ecx, [ebp - 0xd30]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xd2c]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 1
mov dword [ebp - 0xd20], 0
mov dword [ebp - 0xd28], 0
mov dword [ebp - 0x91c], 0
mov dword [ebp - 0xd24], 0
push 0x5b7cb4
lea eax, [ebp - 0xe30]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.LSP1.txt
lea ecx, [ebp - 0xe30]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b7cb4
lea edx, [ebp - 0xb1c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.LSP1.reg
lea eax, [ebp - 0xb1c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b7cb4
lea ecx, [ebp - 0xa1c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.LSP2.txt
lea edx, [ebp - 0xa1c]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b7cb4
lea eax, [ebp - 0x510]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.LSP2.reg
lea ecx, [ebp - 0x510]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.Current_NameSpace_Catalog
push 0x56b030
push 0x80000002
lea edx, [ebp - 0x1360]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x136c], eax
mov eax, dword [ebp - 0x136c]
mov dword [ebp - 0x1370], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1370]
push ecx
lea ecx, [ebp - 0xd30]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1360]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 0xe34], 0
mov edx, dword [ebp - 0xd30]
push edx
push 0x56b068
lea eax, [ebp - 0xc1c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0xd20]
push ecx
push 0x20119
push 0
lea edx, [ebp - 0xc1c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4aef61
push 0x100
lea eax, [ebp - 0x135c]
push eax
mov ecx, dword [ebp - 0xe34]
mov dword [ebp - 0x1374], ecx
mov edx, dword [ebp - 0x1374]
push edx
mov eax, dword [ebp - 0xd20]
push eax
mov ecx, dword [ebp - 0xe34]
add ecx, 1
mov dword [ebp - 0xe34], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4aef61
lea edx, [ebp - 0x135c]
push edx
lea eax, [ebp - 0xc1c]
push eax
push 0x56b0b4
lea ecx, [ebp - 0xd1c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.LibraryPath
lea edx, [ebp - 0xd1c]
push edx
push 0x80000002
lea eax, [ebp - 0x1364]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1378], eax
mov ecx, dword [ebp - 0x1378]
mov dword [ebp - 0x137c], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x137c]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x125c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1364]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x125c]
push eax
call fcn.00401fca
add esp, 4
push 0x56b0c8
lea ecx, [ebp - 0x125c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4aef5c
lea edx, [ebp - 0xd1c]
push edx
push 0x80000002
call fcn.00402a6b
add esp, 8
mov eax, dword [ebp - 0xe34]
sub eax, 1
mov dword [ebp - 0xe34], eax
mov dword [ebp - 0x91c], 1
jmp 0x4aee41
mov ecx, dword [ebp - 0xd20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xe34]
sub edx, 1
mov dword [ebp - 0xe34], edx
cmp dword [ebp - 0x91c], 0
je 0x4af285
mov eax, dword [ebp - 0xd30]
push eax
push 0x56b0dc
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0xa
lea ecx, [ebp - 0xe54]
push ecx
mov edx, dword [ebp - 0xe34]
push edx
call dword [sym.imp.MSVCRT.dll__itoa]
add esp, 0xc
lea eax, [ebp - 0xe54]
push eax
push 0x44
push 0x56b118
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov ecx, dword [ebp - 0xe34]
add ecx, 1
mov dword [ebp - 0xe34], ecx
push 0xa
lea edx, [ebp - 0xe54]
push edx
mov eax, dword [ebp - 0xe34]
push eax
call dword [sym.imp.MSVCRT.dll__itoa]
add esp, 0xc
lea ecx, [ebp - 0xe54]
push ecx
push 0x44
push 0x56b12c
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov edx, dword [ebp - 0xd30]
push edx
push 0x56b140
lea eax, [ebp - 0xc1c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0xc1c]
push ecx
lea edx, [ebp - 0xe30]
push edx
push 0x56b19c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x56b1b8
lea eax, [ebp - 0xe30]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0xe5c], eax
cmp dword [ebp - 0xe5c], 0
je 0x4af285
push 0x56b1bc
lea ecx, [ebp - 0xb1c]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [0x5b84b8], 0
mov edx, dword [ebp - 0xe5c]
push edx
push 0x200
lea eax, [ebp - 0x718]
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
mov ecx, dword [ebp - 0xe5c]
mov edx, dword [ecx + 0xc]
and edx, 0x10
test edx, edx
je 0x4af0f5
jmp 0x4af215
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x918]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x918]
push edx
call fcn.00401fca
add esp, 4
push 0x56b1c0
lea eax, [ebp - 0x918]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4af1f4
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
push 0xa
lea edx, [ebp - 0xe54]
push edx
mov eax, dword [0x5b84b8]
push eax
call dword [sym.imp.MSVCRT.dll__itoa]
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
push 0x56b1dc
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0xd30]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov eax, dword [ebp - 0x10]
push eax
push 0x56b228
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
cmp dword [0x5b84b8], 9
jle 0x4af1ba
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0xe54]
push edx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
jmp 0x4af1e0
mov eax, dword [ebp - 0x10]
push eax
push 0x56b244
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0xe54]
push edx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov eax, dword [ebp - 0x10]
push eax
push 0x56b248
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
jmp 0x4af208
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x718]
push edx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov eax, 1
test eax, eax
jne 0x4af0c4
mov ecx, dword [ebp - 0xe5c]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [ebp - 0xd30]
push eax
push 0x56b24c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
lea ecx, [ebp - 0xb1c]
push ecx
push 0x56b298
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
push str.Current_Protocol_Catalog
push str.SystemCurrentControlSetServicesWinSock2Parameters
push 0x80000002
lea edx, [ebp - 0x1368]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1380], eax
mov eax, dword [ebp - 0x1380]
mov dword [ebp - 0x1384], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1384]
push ecx
lea ecx, [ebp - 0xd2c]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1368]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 0xe34], 0
mov edx, dword [ebp - 0xd2c]
push edx
push 0x56b2fc
lea eax, [ebp - 0xc1c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0xd20]
push ecx
push 0x20119
push 0
lea edx, [ebp - 0xc1c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4af5f5
push 0x100
lea eax, [ebp - 0x135c]
push eax
mov ecx, dword [ebp - 0xe34]
mov dword [ebp - 0x1388], ecx
mov edx, dword [ebp - 0x1388]
push edx
mov eax, dword [ebp - 0xd20]
push eax
mov ecx, dword [ebp - 0xe34]
add ecx, 1
mov dword [ebp - 0xe34], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4af5f5
lea edx, [ebp - 0x135c]
push edx
lea eax, [ebp - 0xc1c]
push eax
push 0x56b348
lea ecx, [ebp - 0xd1c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0xd28]
push edx
push 0x20119
push 0
lea eax, [ebp - 0xd1c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4af5e3
mov dword [ebp - 0xe58], 0
jmp 0x4af3d1
mov ecx, dword [ebp - 0xe58]
add ecx, 1
mov dword [ebp - 0xe58], ecx
mov dword [ebp - 0x518], 0x400
mov byte [ebp - 0x410], 0
mov dword [ebp - 0x514], 0x400
mov byte [ebp - 0x125c], 0
lea edx, [ebp - 0x514]
push edx
lea eax, [ebp - 0x125c]
push eax
push 0
push 0
lea ecx, [ebp - 0x518]
push ecx
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp - 0xe58]
push eax
mov ecx, dword [ebp - 0xd28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x4af5dc
lea edx, [ebp - 0x410]
push edx
call fcn.00401fca
add esp, 4
lea eax, [ebp - 0x125c]
push eax
call fcn.00401fca
add esp, 4
push str.PACKEDCATALOGITEM
lea ecx, [ebp - 0x410]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4af5da
push str.ABENGINE.DLL
lea edx, [ebp - 0x125c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.AELUPSVC32.DLL
lea eax, [ebp - 0x125c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.HELPER32.DLL
lea ecx, [ebp - 0x125c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.HELPERS32.DLL
lea edx, [ebp - 0x125c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.NEWDOTNETNEWDOTNET
lea eax, [ebp - 0x125c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.NTDLL64.DLL
lea ecx, [ebp - 0x125c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.PRLS.DLL
lea edx, [ebp - 0x125c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.WEBHDLL.DLL
lea eax, [ebp - 0x125c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.WINHELPER.DLL
lea ecx, [ebp - 0x125c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.WINHELPER86.DLL
lea edx, [ebp - 0x125c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.ZCENGINE.DLL
lea eax, [ebp - 0x125c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4af5ad
push str.ZDENGINE.DLL
lea ecx, [ebp - 0x125c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4af5da
lea edx, [ebp - 0xd1c]
push edx
push 0x80000002
call fcn.00402a6b
add esp, 8
mov eax, dword [ebp - 0xe34]
sub eax, 1
mov dword [ebp - 0xe34], eax
mov dword [ebp - 0xd24], 1
jmp 0x4af5de
jmp 0x4af5e3
jmp 0x4af3c2
mov ecx, dword [ebp - 0xd28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4af328
mov edx, dword [ebp - 0xd20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xe34]
sub eax, 1
mov dword [ebp - 0xe34], eax
cmp dword [ebp - 0xd24], 0
je 0x4af91a
mov ecx, dword [ebp - 0xd2c]
push ecx
push str.SystemCurrentControlSetServicesWinSock2Parameters_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0xa
lea edx, [ebp - 0xe54]
push edx
mov eax, dword [ebp - 0xe34]
push eax
call dword [sym.imp.MSVCRT.dll__itoa]
add esp, 0xc
lea ecx, [ebp - 0xe54]
push ecx
push 0x44
push str.Num_Catalog_Entries
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov edx, dword [ebp - 0xe34]
add edx, 1
mov dword [ebp - 0xe34], edx
push 0xa
lea eax, [ebp - 0xe54]
push eax
mov ecx, dword [ebp - 0xe34]
push ecx
call dword [sym.imp.MSVCRT.dll__itoa]
add esp, 0xc
lea edx, [ebp - 0xe54]
push edx
push 0x44
push str.Serial_Access_Num
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov eax, dword [ebp - 0xd2c]
push eax
push str.HKEY_LOCAL_MACHINESystemCurrentControlSetServicesWinSock2Parameters_sCatalog_Entries
lea ecx, [ebp - 0xd1c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0xd1c]
push edx
lea eax, [ebp - 0xa1c]
push eax
push str.regedit__e__ascii___s____s_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x56b4f8
lea ecx, [ebp - 0xa1c]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0xe5c], eax
cmp dword [ebp - 0xe5c], 0
je 0x4af91a
push 0x56b4fc
lea edx, [ebp - 0x510]
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [0x5b84b8], 0
mov eax, dword [ebp - 0xe5c]
push eax
push 0x200
lea ecx, [ebp - 0x718]
push ecx
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
mov edx, dword [ebp - 0xe5c]
mov eax, dword [edx + 0xc]
and eax, 0x10
test eax, eax
je 0x4af789
jmp 0x4af8aa
lea ecx, [ebp - 0x718]
push ecx
lea edx, [ebp - 0x918]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x918]
push eax
call fcn.00401fca
add esp, 4
push str.CATALOG_ENTRIES0000000000
lea ecx, [ebp - 0x918]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4af889
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
push 0xa
lea eax, [ebp - 0xe54]
push eax
mov ecx, dword [0x5b84b8]
push ecx
call dword [sym.imp.MSVCRT.dll__itoa]
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
push str._HKEY_LOCAL_MACHINESystemCurrentControlSetServicesWinSock2Parameters_
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0xd2c]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov ecx, dword [ebp - 0x10]
push ecx
push str.Catalog_Entries0000000000
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
cmp dword [0x5b84b8], 9
jle 0x4af84f
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 0xe54]
push eax
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
jmp 0x4af875
mov ecx, dword [ebp - 0x10]
push ecx
push 0x56b584
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 0xe54]
push eax
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov ecx, dword [ebp - 0x10]
push ecx
push 0x56b588
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
jmp 0x4af89d
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 0x718]
push eax
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov ecx, 1
test ecx, ecx
jne 0x4af758
mov edx, dword [ebp - 0xe5c]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 0xd2c]
push ecx
push str.SystemCurrentControlSetServicesWinSock2Parameters_sCatalog_Entries
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x80000002
call fcn.00402a6b
add esp, 8
lea edx, [ebp - 0x510]
push edx
push str.regedit__s___s_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
cmp dword [ebp - 0x91c], 0
jne 0x4af92c
cmp dword [ebp - 0xd24], 0
je 0x4af93b
push str.Restaurado_WinSock2__LSPs_._n
mov ecx, 0x5b5b78
call fcn.0050f680
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd2c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd30]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret