Function at 0x518bd0
Capabilities:
Persist via run registry key
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x518bd8
push ebx
mov ebx, 0x521624
xor eax, eax
push ebp
push 0x518fe4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43eb50]
call fcn.0043ec50
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x518fba
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0043ecf0
xor ecx, ecx
mov edx, 0x518ff8
mov eax, dword [ebp - 8]
call fcn.0043ed54
test al, al
je 0x518ca7
lea edx, [ebp - 0x10]
mov eax, dword [0x51e76c]
mov eax, dword [eax]
call fcn.00480c1c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409d60
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518ca4
lea edx, [ebp - 0x18]
mov eax, dword [0x51e76c]
mov eax, dword [eax]
call fcn.00480c1c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409d60
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0043f248
lea edx, [ebp - 0x1c]
mov eax, dword [0x51e76c]
mov eax, dword [eax]
call fcn.00480c1c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00404bac
sete al
xor al, 1
mov byte [ebx], al
jmp 0x518ca7
mov byte [ebx], 0
mov eax, dword [ebp - 8]
call fcn.0043ecc0
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0043ecf0
mov cl, 1
mov edx, 0x519030
mov eax, dword [ebp - 8]
call fcn.0043ed54
test al, al
je 0x518f9c
mov edx, 0x519058
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518cf6
mov edx, 0x519058
mov eax, dword [ebp - 8]
call fcn.0043f310
mov byte [ebx + 1], al
jmp 0x518d09
mov al, 1
mov byte [ebx], al
mov ecx, eax
mov edx, 0x519058
mov eax, dword [ebp - 8]
call fcn.0043f304
mov edx, 0x519070
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518d2c
mov edx, 0x519070
mov eax, dword [ebp - 8]
call fcn.0043f310
mov byte [ebx + 1], al
jmp 0x518d40
mov al, 1
mov byte [ebx + 1], al
mov ecx, eax
mov edx, 0x519070
mov eax, dword [ebp - 8]
call fcn.0043f304
mov edx, 0x519084
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518d6e
lea ecx, [ebp - 0x20]
mov edx, 0x519084
mov eax, dword [ebp - 8]
call fcn.0043f248
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 4]
call fcn.004047f4
jmp 0x518da3
lea edx, [ebp - 0x28]
mov eax, dword [0x51e76c]
mov eax, dword [eax]
call fcn.00480c1c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00409c98
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 4]
call fcn.004047f4
mov ecx, dword [ebx + 4]
mov edx, 0x519084
mov eax, dword [ebp - 8]
call fcn.0043f21c
mov edx, 0x519098
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518dc6
mov edx, 0x519098
mov eax, dword [ebp - 8]
call fcn.0043f310
mov byte [ebx + 8], al
jmp 0x518dda
mov al, 1
mov byte [ebx + 8], al
mov ecx, eax
mov edx, 0x519098
mov eax, dword [ebp - 8]
call fcn.0043f304
mov edx, 0x5190b4
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518e08
lea ecx, [ebp - 0x2c]
mov edx, 0x5190b4
mov eax, dword [ebp - 8]
call fcn.0043f248
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0xc]
call fcn.004047f4
jmp 0x518e25
lea eax, [ebx + 0xc]
mov edx, 0x5190c4
call fcn.004047f4
mov ecx, dword [ebx + 0xc]
mov edx, 0x5190b4
mov eax, dword [ebp - 8]
call fcn.0043f21c
mov edx, 0x519118
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518e53
lea ecx, [ebp - 0x30]
mov edx, 0x519118
mov eax, dword [ebp - 8]
call fcn.0043f248
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x10]
call fcn.004047f4
jmp 0x518e70
lea eax, [ebx + 0x10]
mov edx, 0x51912c
call fcn.004047f4
mov ecx, dword [ebx + 0x10]
mov edx, 0x519118
mov eax, dword [ebp - 8]
call fcn.0043f21c
mov edx, 0x51917c
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518e9e
lea ecx, [ebp - 0x34]
mov edx, 0x51917c
mov eax, dword [ebp - 8]
call fcn.0043f248
mov edx, dword [ebp - 0x34]
lea eax, [ebx + 0x14]
call fcn.004047f4
jmp 0x518ebb
lea eax, [ebx + 0x14]
mov edx, 0x519190
call fcn.004047f4
mov ecx, dword [ebx + 0x14]
mov edx, 0x51917c
mov eax, dword [ebp - 8]
call fcn.0043f21c
mov edx, 0x5191c0
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518ee9
lea ecx, [ebp - 0x38]
mov edx, 0x5191c0
mov eax, dword [ebp - 8]
call fcn.0043f248
mov edx, dword [ebp - 0x38]
lea eax, [ebx + 0x18]
call fcn.004047f4
jmp 0x518f06
lea eax, [ebx + 0x18]
mov edx, 0x5191d0
call fcn.004047f4
mov ecx, dword [ebx + 0x18]
mov edx, 0x5191c0
mov eax, dword [ebp - 8]
call fcn.0043f21c
mov edx, 0x5191e4
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518f34
lea ecx, [ebp - 0x3c]
mov edx, 0x5191e4
mov eax, dword [ebp - 8]
call fcn.0043f248
mov edx, dword [ebp - 0x3c]
lea eax, [ebx + 0x1c]
call fcn.004047f4
jmp 0x518f51
lea eax, [ebx + 0x1c]
mov edx, 0x5191f8
call fcn.004047f4
mov ecx, dword [ebx + 0x1c]
mov edx, 0x5191e4
mov eax, dword [ebp - 8]
call fcn.0043f21c
mov edx, 0x519208
mov eax, dword [ebp - 8]
call fcn.0043f404
test al, al
je 0x518f7f
lea ecx, [ebp - 0x40]
mov edx, 0x519208
mov eax, dword [ebp - 8]
call fcn.0043f248
mov edx, dword [ebp - 0x40]
lea eax, [ebx + 0x20]
call fcn.004047f4
jmp 0x518f9c
lea eax, [ebx + 0x20]
mov edx, 0x519218
call fcn.004047f4
mov ecx, dword [ebx + 0x20]
mov edx, 0x519208
mov eax, dword [ebp - 8]
call fcn.0043f21c
mov eax, dword [ebp - 8]
call fcn.0043ecc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518fc1
mov eax, dword [ebp - 8]
call fcn.00403970
ret