Function at 0x4133b0
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x46c
push str.revise_llaves
push 1
mov dword [esp + 0x10], 0
call fcn.0040d050
add esp, 8
call fcn.004132b0
test eax, eax
je 0x4133e3
push 0x4331b8
call fcn.00413150
add esp, 4
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0xc]
push edi
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x413438
mov eax, dword [0x434594]
test eax, eax
jne 0x41349c
push str.errt1
push 2
call fcn.0040d050
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x46c
ret
push 0x4331b8
lea ecx, [esp + 0x14c]
push str.__s_nicand.exe___normal
push ecx
mov dword [esp + 0x20], 0x208
call fcn.00418db9
lea edi, [esp + 0x154]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x148]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.BossD
push eax
mov dword [esp + 0x2c], ecx
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x413500
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x413500
mov eax, dword [0x434594]
test eax, eax
jne 0x413d4a
push str.errt2
push 2
call fcn.0040d050
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x46c
ret
mov eax, dword [0x42c9b0]
push 1
test eax, eax
je 0x413520
mov edx, dword [esp + 0x14]
push 0x42e25c
push 1
push 0
push str.TIMEAP
push edx
jmp 0x413533
mov eax, dword [esp + 0x14]
push 0x42e250
push 1
push 0
push str.TIMEAP
push eax
call ebp
mov ecx, dword [esp + 0x10]
push 2
push 0x42e24c
push 1
push 0
push str.SoloDisc
push ecx
call ebp
mov edi, str.C:WINDOWSLEVTEMP
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.C:WINDOWSLEVTEMP
push 1
push eax
push str.TempDir
push edx
call ebp
mov edi, 0x4331b8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x4331b8
push 1
push eax
mov eax, dword [esp + 0x20]
push str.Path
push eax
call ebp
call fcn.004132b0
test eax, eax
jne 0x4135bc
mov edi, 0x4331b8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push 0x4331b8
push 1
push eax
push str.PathPub
push ecx
call ebp
lea edx, [esp + 0x1c]
push edx
push str.SLEEP
call fcn.00413020
add esp, 8
cmp eax, 1
jge 0x4135e5
lea eax, [esp + 0x1c]
push 0x42e234
push eax
call fcn.00418db9
add esp, 8
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Sleep
push edx
call ebp
lea eax, [esp + 0x14]
lea ecx, [esp + 0x148]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
mov esi, 0xbe
push str.Remcon
push eax
mov dword [esp + 0x2c], esi
call ebx
lea ecx, [esp + 0x1c]
push ecx
push str.GLOBAL
call fcn.00413020
add esp, 8
cmp eax, 1
jge 0x413653
lea edx, [esp + 0x1c]
push 0x42e250
push edx
jmp 0x41365d
lea eax, [esp + 0x1c]
push 0x42e218
push eax
call fcn.00418db9
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Remcon
push edx
call ebp
lea eax, [esp + 0x148]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00422610
add esp, 8
test eax, eax
je 0x4136aa
mov dword [0x4344ec], 1
lea edx, [esp + 0x14]
lea eax, [esp + 0x148]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.Remot
push edx
mov dword [esp + 0x2c], esi
call ebx
lea eax, [esp + 0x1c]
push eax
push str.REMOT
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Remot
push edx
call ebp
lea eax, [esp + 0x148]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00422610
add esp, 8
test eax, eax
je 0x413725
mov dword [0x4344ec], 1
mov edx, dword [0x42c4dc]
lea eax, [esp + 0x1c]
push edx
push 0x42dd28
push eax
call fcn.00418db9
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Version
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REMOTSERV
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.RemotServ
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.DAYSDISCOV
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.DAYSDISCOV
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.DAYSDIRECT
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.DAYSDIRECT
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPALLEXES
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPALLEXES
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.INFOEXE
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.INFOEXE
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPINFARCHS
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPINFARCHS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPTAMARCHS
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPTAMARCHS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPINFDIRS
call fcn.00413020
add esp, 8
or ecx, 0xffffffff
lea edi, [esp + 0x1c]
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPINFDIRS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPINFEXTS
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPINFEXTS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.AUDITDAYS
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.AUDITDAYS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.AUDITDIRS
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.AUDITDIRS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.AUDITTAMDIR
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
mov edx, dword [esp + 0x18]
push 1
push eax
push str.AUDITTAMDIR
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPTAMDIRS
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPTAMDIRS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.WAKEUP
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.WAKEUP
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.ASKCONFIRM
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.ASKCONFIRM
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.DAYSCONFIRM
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.DAYSCONFIRM
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.ServFiles
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.SERVFILES
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.DISPLAY
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.DISPLAY
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.STOREMIN
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.STOREMIN
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.STOREALL
call fcn.00413020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.STOREALL
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.STOREPATH
call fcn.00413020
lea ecx, [esp + 0x24]
push ecx
call fcn.00413300
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x1c]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.STOREPATH
push eax
call ebp
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.Start
push ecx
mov dword [esp + 0x2c], esi
call ebx
test eax, eax
je 0x413c3a
lea edx, [esp + 0x1c]
push edx
push str.START
call fcn.00413020
mov al, byte [esp + 0x24]
add esp, 8
test al, al
jne 0x413c18
mov edi, 0x42e24c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0xbe
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Start
push edx
call ebp
push 0x433620
lea eax, [esp + 0x354]
push str._sconfig.txt
push eax
mov byte [esp + 0x28], 0
call fcn.00418db9
lea ecx, [esp + 0x28]
push ecx
push str.SEND
call fcn.00413020
add esp, 0x14
test eax, eax
jl 0x413c8e
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.SERVER1
push eax
call ebp
lea ecx, [esp + 0x1c]
push ecx
push str.IDIOM
call fcn.00413020
add esp, 8
test eax, eax
jl 0x413cc6
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.Idiom
push eax
call ebp
lea ecx, [esp + 0x1c]
push ecx
push str.SENDDIR
call fcn.00412e50
add esp, 8
test eax, eax
jl 0x413cfe
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.SendDir
push eax
call ebp
lea ecx, [esp + 0x1c]
push 0x42bb90
push ecx
call fcn.00418db9
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x1c]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.INSTOK
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413d4f
mov esi, 0xbe
lea eax, [esp + 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareLeverITChat
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x413db1
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareLeverITChat
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x413db1
mov eax, dword [0x434594]
test eax, eax
jne 0x413f7b
push str.errt3
push 2
call fcn.0040d050
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x46c
ret
push 0x4331b8
lea edx, [esp + 0x20]
push str._sChat
push edx
call fcn.00418db9
lea eax, [esp + 0x28]
push eax
call fcn.00411cb0
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Path
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.PORTCCLIENTS
call fcn.00412e50
add esp, 8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x148]
lea eax, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push 0
push str.PORTCCLIENTS
push ecx
mov dword [esp + 0x2c], esi
call ebx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.PORTCCLIENTS
push eax
call ebp
lea ecx, [esp + 0x148]
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.00422610
add esp, 8
test eax, eax
je 0x413e6f
mov dword [0x4344ec], 1
lea eax, [esp + 0x1c]
push eax
push str.PORTCCLIENTC
call fcn.00412e50
add esp, 8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x148]
lea eax, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push 0
push str.PORTCCLIENTC
push ecx
mov dword [esp + 0x2c], esi
call ebx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.PORTCCLIENTC
push eax
call ebp
lea ecx, [esp + 0x148]
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.00422610
add esp, 8
test eax, eax
je 0x413eea
mov dword [0x4344ec], 1
lea eax, [esp + 0x1c]
push eax
push str.PORTHUSR
call fcn.00412e50
add esp, 8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x148]
lea eax, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push 0
push str.PORTHUSR
push ecx
mov dword [esp + 0x2c], esi
call ebx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.PORTHUSR
push eax
call ebp
lea ecx, [esp + 0x148]
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.00422610
add esp, 8
test eax, eax
je 0x413f65
mov dword [0x4344f0], 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00416990
push str.revlla1
push 2
call fcn.0040d050
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x46c
ret