Function at 0x413770
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bad81
mov eax, dword fs:[0]
push eax
sub esp, 0x2e4
mov eax, dword [0x6877f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x30
push str.Start_Checking_Configuration_Files_in_SVC_Folder
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x168], 0xf
mov byte [ebp - 0x17c], 0
call fcn.0040a020
lea eax, [ebp - 0x17c]
mov dword [ebp - 4], 0
push eax
call fcn.00418b30
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0x168]
cmp edx, 0x10
jb 0x413825
mov ecx, dword [ebp - 0x17c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41381b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144b7
push edx
push ecx
call fcn.00575155
add esp, 8
push str.CTESComponentsSVC
lea ecx, [ebp - 0x220]
call fcn.00428490
mov dword [ebp - 4], 1
call fcn.00418010
push eax
lea ecx, [ebp - 0x2c4]
call fcn.00428330
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0x220]
push ecx
mov ecx, eax
call fcn.004288b0
mov ecx, eax
call fcn.0042ac80
lea ecx, [ebp - 0x2c4]
call fcn.004285d0
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 5
call fcn.004285d0
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2cc], 0
push eax
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x2d0], 4
push eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d4], 4
push eax
push str.ConfigCheckTS
push str.SystemCurrentControlSet_servicesCtesHostSvcProviders
push connect
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ecx, dword [0x68df2c]
test eax, eax
cmove ecx, dword [ebp - 0x2cc]
mov dword [0x68df2c], ecx
call fcn.00411120
push 0
push 0
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0x2dc], 0
call fcn.00415400
mov dword [ebp - 0x2e0], eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 6
call fcn.00413510
mov edi, dword [ebp - 0x2e0]
mov byte [ebp - 0x2c5], 0
mov dword [ebp - 0x2d8], edi
mov esi, dword [edi]
mov dword [ebp - 0x2d4], esi
cmp esi, edi
je 0x41419a
push 6
push str.CONFIG
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x168], 0xf
mov byte [ebp - 0x17c], 0
call fcn.0040a020
push 0x104
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 7
push 0
push eax
call fcn.0058db90
lea ecx, [ebp - 0x118]
add esp, 0xc
lea ebx, [esi + 8]
mov eax, ecx
mov edx, 0x104
sub ebx, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4139b9
mov al, byte [ecx + ebx]
test al, al
je 0x4139b9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4139a0
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4139d0
mov ebx, dword [ebp - 0x168]
sub ecx, edx
mov edx, dword [ebp - 0x16c]
mov eax, ebx
sub eax, edx
mov dword [ebp - 0x2d0], ecx
push ecx
cmp ecx, eax
ja 0x413a2c
lea eax, [edx + ecx]
cmp ebx, 0x10
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x17c]
cmovae eax, dword [ebp - 0x17c]
lea ebx, [eax + edx]
lea eax, [ebp - 0x118]
push eax
push ebx
call fcn.0058d610
mov eax, dword [ebp - 0x2d0]
add esp, 0xc
mov byte [ebx + eax], 0
jmp 0x413a4c
lea eax, [ebp - 0x118]
mov byte [ebp - 0x2e4], 0
push eax
push dword [ebp - 0x2e4]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.0040cab0
lea eax, [ebp - 0x1b0]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x220]
call fcn.00428330
lea eax, [ebp - 0x17c]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x2c4]
call fcn.00428330
lea eax, [ebp - 0x2c4]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x220]
call fcn.004288b0
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 9
call fcn.004285d0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x254]
call fcn.004261f0
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0xb
call fcn.004269d0
test al, al
je 0x413df3
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x254]
call fcn.00426a60
push 0
push 0xf4240
push dword [eax + 4]
push dword [eax]
call fcn.00575bb0
mov ebx, eax
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x2cc], ebx
call fcn.00406510
cmp ebx, dword [0x68df2c]
jb 0x413c48
push 0x3a
push str.Found_component_that_needs_to_be_updated:__s_with_time__lu
lea ecx, [ebp - 0x148]
mov byte [ebp - 0x2c5], 1
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
call fcn.0040a020
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x164]
call fcn.00419ad0
mov ebx, eax
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0xd
push eax
mov ecx, ebx
call fcn.0041a190
push dword [ebp - 0x2cc]
mov ecx, ebx
call fcn.0041a040
lea eax, [ebp - 0x130]
mov ecx, ebx
push eax
call fcn.0041a330
push eax
mov byte [ebp - 4], 0xe
call fcn.00418c70
mov byte [ebp - 4], 0xd
add esp, 4
mov edx, dword [ebp - 0x11c]
cmp edx, 0x10
jb 0x413bcc
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413bc2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144bc
push edx
push ecx
call fcn.00575155
add esp, 8
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
call fcn.00419ba0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x134]
cmp edx, 0x10
jb 0x413c30
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413c26
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144c1
push edx
push ecx
call fcn.00575155
add esp, 8
push 1
lea edx, [esi + 8]
lea ecx, [ebp - 0x118]
call fcn.00410ba0
add esp, 4
jmp 0x413f76
push 0x63
push str.Checked_file__s__does_not_need_to_update_because_lastModifiedTime_is__lu_and_lastConfig_time_is__lu
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
call fcn.0040a020
lea eax, [ebp - 0x160]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x220]
call fcn.0042ac80
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x198]
call fcn.00419ad0
mov ebx, eax
mov eax, dword [0x68df2c]
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 0x13
push eax
mov ecx, ebx
call fcn.00419c20
push dword [ebp - 0x2cc]
mov ecx, ebx
call fcn.0041a040
push dword [ebp - 0x2d0]
mov ecx, ebx
call fcn.0041a040
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x134]
cmp edx, 0x10
jb 0x413d1f
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413d15
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144c6
push edx
push ecx
call fcn.00575155
add esp, 8
mov ecx, ebx
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
call fcn.0041a330
push eax
mov byte [ebp - 4], 0x14
call fcn.00418b30
mov byte [ebp - 4], 0x12
add esp, 4
mov edx, dword [ebp - 0x14c]
cmp edx, 0x10
jb 0x413d8c
mov ecx, dword [ebp - 0x160]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413d82
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144cb
push edx
push ecx
call fcn.00575155
add esp, 8
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0xf
mov byte [ebp - 0x160], 0
call fcn.00419ba0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x11c]
cmp edx, 0x10
jb 0x413f76
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413f6c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144d0
jmp 0x413f6c
push 0x20
push str.Config_File_does_not_exist_at__s
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
call fcn.0040a020
lea eax, [ebp - 0x160]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x220]
call fcn.0042ac80
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x198]
call fcn.00419ad0
mov ebx, eax
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x19
push eax
mov ecx, ebx
call fcn.00419c20
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x11c]
cmp edx, 0x10
jb 0x413ea5
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413e9b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144d5
push edx
push ecx
call fcn.00575155
add esp, 8
mov ecx, ebx
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
call fcn.0041a330
push eax
mov byte [ebp - 4], 0x1a
call fcn.004194a0
mov byte [ebp - 4], 0x18
add esp, 4
mov edx, dword [ebp - 0x14c]
cmp edx, 0x10
jb 0x413f12
mov ecx, dword [ebp - 0x160]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413f08
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144da
push edx
push ecx
call fcn.00575155
add esp, 8
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0xf
mov byte [ebp - 0x160], 0
call fcn.00419ba0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x134]
cmp edx, 0x10
jb 0x413f76
mov ecx, dword [ebp - 0x148]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x413f6c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144df
push edx
push ecx
call fcn.00575155
add esp, 8
lea ecx, [ebp - 0x254]
call fcn.00426400
lea ecx, [ebp - 0x220]
call fcn.004285d0
mov dword [ebp - 4], 7
jmp 0x414155
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x168]
cmp edx, 0x10
jb 0x414193
mov ecx, dword [ebp - 0x17c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414189
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144e4
push edx
push ecx
call fcn.00575155
add esp, 8
mov esi, dword [esi]
jmp 0x413930
cmp byte [ebp - 0x2c5], 0
je 0x41429b
sub esp, 8
lea eax, [ebp - 0x2e0]
mov ecx, esp
push eax
call fcn.004152d0
call fcn.004131e0
add esp, 8
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
lea ecx, [ebp - 0x130]
mov byte [ebp - 0x130], 0
test eax, eax
je 0x41423e
push 0x30
push str.ProviderList_updated_in_CheckConfigFilesInFolder
call fcn.0040a020
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x22
push eax
call fcn.00418b30
mov byte [ebp - 4], 6
add esp, 4
mov edx, dword [ebp - 0x11c]
cmp edx, 0x10
jb 0x41429b
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414291
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144e9
jmp 0x414291
push 0x39
push str.ProviderList_Failed_to_update_in_CheckConfigFilesInFolder
call fcn.0040a020
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x23
push eax
call fcn.00418bd0
mov byte [ebp - 4], 6
add esp, 4
mov edx, dword [ebp - 0x11c]
cmp edx, 0x10
jb 0x41429b
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414291
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144ee
push edx
push ecx
call fcn.00575155
add esp, 8
call fcn.00405ff0
push 4
mov dword [0x68df2c], eax
mov dword [ebp - 0x2d8], eax
lea eax, [ebp - 0x2d8]
push eax
push 4
push str.ConfigCheckTS
push str.SystemCurrentControlSet_servicesCtesHostSvcProviders
push connect
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0x120], 0
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
test eax, eax
jne 0x4143da
push 0x24
push str.ConfigCheckTS_updated_with_value__lu
call fcn.0040a020
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0x198]
call fcn.00419ad0
mov esi, eax
mov byte [ebp - 4], 0x25
mov ecx, esi
push dword [0x68df2c]
call fcn.0041a040
lea eax, [ebp - 0x160]
mov ecx, esi
push eax
call fcn.0041a330
push eax
mov byte [ebp - 4], 0x26
call fcn.00418b30
mov edx, dword [ebp - 0x14c]
add esp, 4
cmp edx, 0x10
jb 0x41437e
mov ecx, dword [ebp - 0x160]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414374
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144f3
push edx
push ecx
call fcn.00575155
add esp, 8
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0xf
mov byte [ebp - 0x160], 0
call fcn.00419ba0
mov edx, dword [ebp - 0x11c]
cmp edx, 0x10
jb 0x414436
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41442c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144f8
jmp 0x41442c
push 0x2b
push str.ConfigCheckTS_updated_failed_with_value__lu
call fcn.0040a020
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x198]
call fcn.00419ad0
mov esi, eax
mov byte [ebp - 4], 0x28
mov ecx, esi
push dword [0x68df2c]
call fcn.0041a040
lea eax, [ebp - 0x160]
mov ecx, esi
push eax
call fcn.0041a330
push eax
mov byte [ebp - 4], 0x29
call fcn.00418bd0
jmp 0x414341
push edx
push ecx
call fcn.00575155
add esp, 8
mov ebx, dword [ebp - 0x2e0]
mov eax, dword [ebx]
mov dword [ebx], ebx
mov dword [ebx + 4], ebx
cmp eax, ebx
je 0x41445a
mov esi, dword [eax]
push 0x1c
push eax
call fcn.00575155
add esp, 8
mov eax, esi
cmp esi, ebx
jne 0x414447
push 0x1c
push ebx
call fcn.00575155
mov edx, dword [ebp - 0x19c]
add esp, 8
cmp edx, 0x10
jb 0x41449b
mov ecx, dword [ebp - 0x1b0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414491
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4144f3
push edx
push ecx
call fcn.00575155
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00574c7a
mov esp, ebp
pop ebp
ret
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
int3