Function at 0x463850
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670790
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1b68
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ecx, 0x21e
mov esi, str.REGISTRYMACHINESOFTWAREMicroWorld_REGISTRYMACHINESOFTWAREClasseseScan.Net_REGISTRYMACHINESOFTWAREClassesEutAppList_REGISTRYMACHINESOFTWAREClassesEutAllowList_REGISTRYMACHINESOFTWAREClassesEutRegList__REGISTRYMACHINESOFTWAREClassesAppId06622D85_6856_4460_8DE1_A81921B41C4B_REGISTRYMACHINESOFTWAREClassesCLSID42aedc87_2188_41fd_b9a3_0c966feabec1_REGISTRYMACHINESOFTWAREClassesCLSIDF3130CDB_AA52_4C3A_AB32_85FFC23AF9C1_REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify__REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWindows__REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost__REGISTRYCCSTControlSecurityProviders__REGISTRYCCSTControlSafeBoot__REGISTRYCCSTControlLsaExtensionConfigLsaSrv__REGISTRYCCSTControlSession_ManagerSubSystems__REGISTRYCCSTControlBootVerificationProgram__REGISTRYCCSTServiceseconceal__REGISTRYCCSTServices_avdiskCDKey__REGISTRYCCSTServices_avdiskUSBKey_REGISTRYCCSTServices_bdfsfltr_REGISTRYCCSTServiceseconservice_REGISTRYCCSTServiceseScan_Monitor_Service_REGISTRYCCSTServiceseScan_trayicos_REGISTRYCCSTServiceseScan_trayicoc_REGISTRYCCSTServicesmwagent_REGISTRYCCSTServicesWinSock2_REGISTRYCCSTServicesWinSock__REGISTRYMACHINESYSTEMWPA_REGISTRYMACHINESYSTEMSelect_REGISTRYCCSTServices_avc3_REGISTRYCCSTServices_avchv_REGISTRYCCSTServices_avckf_REGISTRYCCSTServicesProcObsrv_REGISTRYCCSTServicesProcObsrves_REGISTRYCCSTServicesProcObsrvesx_REGISTRYMACHINESOFTWAREAVC3_REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_REGISTRYMACHINESOFTWAREMicrosoftInternet_ExplorerToolbar_REGISTRYMACHINESOFTWAREMicrosoftInternet_ExplorerExtensions_REGISTRYMACHINESOFTWAREMicrosoftInternet_ExplorerURLSearchHooks_REGISTRYMACHINESOFTWAREMicrosoftInternet_ExplorerExplorer_Bars__REGISTRYCCSTControlTimeZoneInformation__REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
lea edi, [ebp - 0x1b20]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x185
xor ebx, ebx
push ebx
lea eax, [ebp - 0x12a5]
push eax
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x1b30], ebx
mov dword [ebp - 0x1b58], ebx
mov dword [ebp - 0x1b44], ebx
mov dword [ebp - 0x1b54], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1b30]
push ecx
mov esi, 1
push esi
push ebx
push str.SOFTWAREClasseseScan.NET
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
cmp eax, ebx
je 0x463912
lea edx, [ebp - 0x1b30]
push edx
push str.SOFTWAREClasseseScan.NET
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [ebp - 0x1b30]
cmp eax, ebx
je 0x463929
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b30], ebx
push ebx
lea eax, [ebp - 0x1b4c]
push eax
push str.ProtectWinsockEx
call fcn.00450100
push esi
lea ecx, [ebp - 0x1b64]
push ecx
push str.ProtectAppId
call fcn.00450100
push esi
lea edx, [ebp - 0x1b70]
push edx
push str.ProtectCLSID
call fcn.00450100
push esi
lea eax, [ebp - 0x1b78]
push eax
push str.ProtectEScanServices
call fcn.00450100
push esi
lea ecx, [ebp - 0x1b68]
push ecx
push str.ProtectIFEO
call fcn.00450100
push esi
lea edx, [ebp - 0x1b5c]
push edx
push str.ProtectWinlogon
call fcn.00450100
add esp, 0x48
push esi
lea eax, [ebp - 0x1b60]
push eax
push str.ProtectWindows
call fcn.00450100
push esi
lea ecx, [ebp - 0x1b48]
push ecx
push str.ProtectSvcHost
call fcn.00450100
push esi
lea edx, [ebp - 0x1b80]
push edx
push str.ProtectEConceal
call fcn.00450100
push esi
lea eax, [ebp - 0x1b74]
push eax
push str.ProtectControl
call fcn.00450100
push esi
lea ecx, [ebp - 0x1b6c]
push ecx
push str.ProtectSYSTEM
call fcn.00450100
add esp, 0x3c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push eax
push ebx
push 0x2000702
call dword [0x6e9118]
mov byte [ebp - 0x41c], bl
push 0x3ff
push ebx
lea edx, [ebp - 0x41b]
push edx
call fcn.005dfd60
mov byte [ebp - 0xc1c], bl
push 0x3ff
push ebx
lea eax, [ebp - 0xc1b]
push eax
call fcn.005dfd60
add esp, 0x28
mov dword [ebp - 0x1b34], ebx
mov dword [ebp - 0x1b40], ebx
mov dword [ebp - 0x1b50], ebx
call fcn.004d9b00
test eax, eax
je 0x463a5d
mov dword [ebp - 0x1b40], esi
mov ecx, dword [0x6b079c]
mov dword [ebp - 0x1b28], ecx
call fcn.004d9a70
test eax, eax
je 0x463a78
mov dword [ebp - 0x1b58], esi
call fcn.004d9950
test eax, eax
je 0x463a87
mov dword [ebp - 0x1b44], esi
call fcn.004f79d0
test eax, eax
je 0x463aa4
cmp dword [0x7302bc], esi
je 0x463a9e
mov dword [ebp - 0x1b5c], ebx
mov dword [ebp - 0x1b54], esi
lea edx, [ebp - 0x1b50]
push edx
push str.SecurityMode
push str.SoftwareMicroWorldeConcealeConceal_FirewallCommon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push esi
push ebx
push 0x2c
lea eax, [ebp - 0x1b34]
push eax
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x1b20]
push edx
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x1b34], 0xffffffff
je 0x46420c
xor edi, edi
mov dword [ebp - 0x1b7c], edi
mov esi, 1
mov dword [ebp - 0x1b24], esi
xor eax, eax
cmp eax, ebx
je 0x463b1b
lea eax, [ebp - 0x41c]
push eax
push str._REG___s
push ebx
call fcn.004f0f30
add esp, 0xc
cmp dword [ebp - 0x1b58], ebx
je 0x463b55
push str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWindows
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x463b55
cmp eax, ebx
je 0x463b4d
push str._REG__FALSE__a0_
push ebx
call fcn.004f0f30
add esp, 8
xor esi, esi
mov dword [ebp - 0x1b24], esi
mov eax, 1
cmp dword [0x6b0778], eax
je 0x463b72
cmp dword [ebp - 0x1b80], ebx
je 0x463b72
cmp dword [ebp - 0x1b50], eax
je 0x463ba4
push str._REGISTRYCCSTServiceseconceal
lea edx, [ebp - 0x41c]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x463ba4
cmp eax, ebx
je 0x463b9c
push str._REG__FALSE__a1_
push ebx
call fcn.004f0f30
add esp, 8
xor esi, esi
mov dword [ebp - 0x1b24], esi
cmp dword [ebp - 0x1b44], ebx
jne 0x463bb5
call fcn.004f7ac0
test eax, eax
je 0x463bf3
mov dword [ebp - 0x1b48], ebx
mov dword [ebp - 0x1b4c], ebx
push str._REGISTRYMACHINESYSTEMWPA
lea eax, [ebp - 0x41c]
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x463bf3
cmp eax, ebx
je 0x463beb
push str._REG__FALSE__a2_
push ebx
call fcn.004f0f30
add esp, 8
xor esi, esi
mov dword [ebp - 0x1b24], esi
cmp dword [ebp - 0x1b4c], ebx
je 0x463c03
cmp dword [ebp - 0x1b54], ebx
je 0x463c4f
push str.REGISTRYCCSTServicesWinSock2
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x463c33
push str.REGISTRYCCSTServicesWinSock
lea edx, [ebp - 0x41c]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x463c4f
xor eax, eax
cmp eax, ebx
je 0x463c47
push str._REG__FALSE__a4_
push ebx
call fcn.004f0f30
add esp, 8
xor esi, esi
mov dword [ebp - 0x1b24], esi
push ebx
push str.Extensions
lea eax, [ebp - 0x41c]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x463c9d
push ebx
push str.Internet_Explorer_
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x463c9d
push ebx
push str.Explorer_
lea edx, [ebp - 0x41c]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463cd0
mov edi, 1
mov dword [ebp - 0x1b7c], edi
cmp esi, ebx
je 0x463cd0
cmp dword [0x7302cc], ebx
jne 0x463cd0
xor eax, eax
cmp eax, ebx
je 0x463cc8
push str._REG__FALSE__a5_
push ebx
call fcn.004f0f30
add esp, 8
xor esi, esi
mov dword [ebp - 0x1b24], esi
push ebx
push str.TimeZoneInformation
lea eax, [ebp - 0x41c]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463d13
cmp dword [0x7302d4], ebx
jne 0x463d13
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a6_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
cmp esi, ebx
je 0x464205
cmp dword [ebp - 0x1b64], ebx
jne 0x463d5e
push ebx
push str.ClassesAppId
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463d5e
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a7_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
cmp dword [ebp - 0x1b68], ebx
jne 0x463da1
push ebx
push str.Image_File_Execution_Options
lea edx, [ebp - 0x41c]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463da1
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a8_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
cmp dword [ebp - 0x1b70], ebx
jne 0x463de8
push ebx
push str.ClassesCLSID
lea eax, [ebp - 0x41c]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463de8
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a9_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
cmp dword [ebp - 0x1b78], ebx
jne 0x463e2f
push ebx
push str.CCSTServices
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463e2f
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a10_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
cmp dword [ebp - 0x1b5c], ebx
jne 0x463e76
push ebx
push str.CurrentVersionWinlogon
lea edx, [ebp - 0x41c]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463e76
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a11_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
cmp dword [ebp - 0x1b60], ebx
jne 0x463ebd
push ebx
push str.CurrentVersionWindows
lea eax, [ebp - 0x41c]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463ebd
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a12_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
cmp dword [ebp - 0x1b48], ebx
jne 0x463f04
push ebx
push str.CurrentVersionSvcHost
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463f04
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a13_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
cmp dword [ebp - 0x1b74], ebx
jne 0x463f4b
push ebx
push str.CCSTControl
lea edx, [ebp - 0x41c]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463f4b
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a14_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
cmp dword [ebp - 0x1b6c], ebx
jne 0x463f92
push ebx
push str.MACHINESYSTEM
lea eax, [ebp - 0x41c]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x463f92
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a15_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
cmp esi, ebx
je 0x464205
cmp dword [ebp - 0x1b28], ebx
je 0x463fc5
cmp edi, ebx
je 0x463fc5
xor eax, eax
cmp eax, ebx
je 0x463fba
push str._REG__FALSE__a16_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
jmp 0x4640ae
lea ecx, [ebp - 0xc1c]
push ecx
lea edx, [ebp - 0x41c]
push edx
call fcn.00463640
add esp, 8
cmp byte [ebp - 0xc1c], bl
je 0x464087
lea eax, [ebp - 0x1b3c]
push eax
push 1
push ebx
lea ecx, [ebp - 0xc1c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
cmp eax, ebx
je 0x46406f
cmp edi, ebx
je 0x46404f
lea edx, [ebp - 0x1b3c]
push edx
lea eax, [ebp - 0xc1c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x464033
mov ecx, dword [ebp - 0x1b3c]
push ecx
jmp 0x464076
xor eax, eax
cmp eax, ebx
je 0x463fba
push str._REG__FALSE__a17_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
jmp 0x4640ae
xor eax, eax
cmp eax, ebx
je 0x463fba
push str._REG__FALSE__a18_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
jmp 0x4640ae
mov edx, dword [ebp - 0x1b3c]
push edx
mov esi, 1
mov dword [ebp - 0x1b24], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x4640ae
xor eax, eax
cmp eax, ebx
je 0x46409f
push str._REG__Adding__a_
push ebx
call fcn.004f0f30
add esp, 8
lea eax, [ebp - 0x41c]
push eax
call fcn.00463210
add esp, 4
cmp dword [ebp - 0x1b28], ebx
je 0x464205
xor esi, esi
mov dword [ebp - 0x1b24], 1
push str.REGISTRYMACHINESOFTWAREAVC3
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4640e3
lea esi, [eax + 1]
jmp 0x464104
push str.REGISTRYMACHINESOFTWAREWow6432Node
push str.REGISTRYMACHINESOFTWARE
lea edx, [ebp - 0x41c]
push edx
call fcn.004e9030
add esp, 0xc
test eax, eax
je 0x464205
cmp dword [ebp - 0x1b40], ebx
jne 0x464114
cmp esi, ebx
je 0x4641e2
lea eax, [ebp - 0xc1c]
push eax
lea ecx, [ebp - 0x41c]
push ecx
call fcn.00463640
add esp, 8
cmp byte [ebp - 0xc1c], bl
je 0x4641e2
lea edx, [ebp - 0x1b38]
push edx
push 0x20119
push ebx
lea eax, [ebp - 0xc1c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004fadc0
cmp eax, ebx
je 0x4641cb
cmp edi, ebx
je 0x4641a6
lea ecx, [ebp - 0x1b38]
push ecx
lea edx, [ebp - 0xc1c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00503d40
test eax, eax
jne 0x464181
mov eax, dword [ebp - 0x1b38]
push eax
jmp 0x4641d2
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a19_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
xor eax, eax
cmp eax, ebx
je 0x463d06
push str._REG__FALSE__a20_
push ebx
call fcn.004f0f30
add esp, 8
mov dword [ebp - 0x1b24], ebx
push 1
jmp 0x463ac0
mov ecx, dword [ebp - 0x1b38]
push ecx
mov dword [ebp - 0x1b24], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, ebx
je 0x4641f6
push str._REG__Adding__b_
push ebx
call fcn.004f0f30
add esp, 8
lea edx, [ebp - 0x41c]
push edx
call fcn.00463210
add esp, 4
push 1
jmp 0x463ac0
mov byte [ebp - 0x81c], bl
push 0x3ff
push ebx
lea eax, [ebp - 0x81b]
push eax
call fcn.005dfd60
add esp, 0xc
mov esi, 0x400
mov dword [ebp - 0x1b2c], esi
lea ecx, [ebp - 0x1b2c]
push ecx
lea edx, [ebp - 0x1120]
push edx
push str.eScan_Updater
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp al, 1
jne 0x46429c
push str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRuneScan_Updater
lea eax, [ebp - 0x81c]
push eax
call edi
cmp dword [ebp - 0x1b28], ebx
je 0x46428d
push str.REGISTRYMACHINESOFTWAREWow6432Node
push str.REGISTRYMACHINESOFTWARE
lea ecx, [ebp - 0x81c]
push ecx
call fcn.004e9030
add esp, 0xc
lea edx, [ebp - 0x81c]
push edx
call fcn.00463020
add esp, 4
mov byte [ebp - 0x1120], bl
mov dword [ebp - 0x1b2c], esi
lea eax, [ebp - 0x1b2c]
push eax
lea ecx, [ebp - 0x1120]
push ecx
push str.eScan_Server
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
cmp al, 1
jne 0x46430c
push str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRuneScan_Server
lea edx, [ebp - 0x81c]
push edx
call edi
cmp dword [ebp - 0x1b28], ebx
je 0x4642fd
push str.REGISTRYMACHINESOFTWAREWow6432Node
push str.REGISTRYMACHINESOFTWARE
lea eax, [ebp - 0x81c]
push eax
call fcn.004e9030
add esp, 0xc
lea ecx, [ebp - 0x81c]
push ecx
call fcn.00463020
add esp, 4
mov byte [ebp - 0x1120], bl
mov dword [ebp - 0x1b2c], esi
lea edx, [ebp - 0x1b2c]
push edx
lea eax, [ebp - 0x1120]
push eax
push str.MailScan_Dispatcher
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
cmp al, 1
jne 0x4643a9
push ebx
push 0x104
lea ecx, [ebp - 0xd20]
push ecx
push 0x60c81c
push str.eScanInstalledWithMailScanSupport
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [ebp - 0xd20], 0x31
jne 0x4643a9
push str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRunMailScan_Dispatcher
lea edx, [ebp - 0x81c]
push edx
call edi
cmp dword [ebp - 0x1b28], ebx
je 0x46439a
push str.REGISTRYMACHINESOFTWAREWow6432Node
push str.REGISTRYMACHINESOFTWARE
lea eax, [ebp - 0x81c]
push eax
call fcn.004e9030
add esp, 0xc
lea ecx, [ebp - 0x81c]
push ecx
call fcn.00463020
add esp, 4
cmp dword [0x75f250], ebx
jne 0x4643f2
cmp dword [0x69bacc], 2
jne 0x4643f2
push 0x69bbd4
push str.ProtectInterfaces
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [0x69bbd4], ebx
je 0x4643f2
push str.REGISTRYCCSTServicesTcpipParametersInterfaces
call fcn.00463210
add esp, 4
mov dword [0x75f258], 1
call fcn.00463760
mov dword [0x75f25c], 1
jmp 0x464422
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret