Function at 0x413140
Capabilities:
Contain obfuscated stackstrings
Delete file
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4767d0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x4bc00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
call fcn.00403ac0
mov ecx, eax
test ecx, ecx
je 0x414399
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
mov byte [ebp - 0x11], 0
xor bl, bl
mov byte [ebp - 0x12], bl
lea ecx, [ebp - 0x28]
call fcn.004027e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.004027e0
mov byte [ebp - 4], 4
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesCVirtADisplayName
lea ecx, [ebp - 0x30]
call fcn.0045fcf0
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x48d10a
call fcn.0045fcf0
mov byte [ebp - 4], 6
push ecx
mov dword [ebp - 0x5c], esp
mov dword [ebp - 0x48], esp
mov esi, dword [ebp - 0x30]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413202
cmp ecx, dword [esi - 0x10]
jne 0x413202
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x41322c
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4143a3
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.004662c0
add esp, 8
mov edx, 0x48d10a
lea ecx, [ebp - 0x28]
call fcn.0045eff0
test al, al
je 0x4132cc
mov bl, 1
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.net_stop_vpnagent
call fcn.0045fcf0
mov byte [ebp - 4], 9
mov byte [ebp - 4], 5
mov dl, bl
lea ecx, [ebp - 0x34]
call fcn.004642f0
add esp, 4
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x34]
call fcn.0045f7b0
push ecx
push str.the_service_name_is_invalid
lea ecx, [ebp - 0x34]
call fcn.0045f840
test eax, eax
setns bl
mov byte [ebp - 0x12], bl
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4132cf
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x4132cf
or esi, 0xffffffff
mov edx, 0x48d10a
lea ecx, [ebp - 0x28]
call fcn.0045f100
test al, al
jne 0x413ff9
cmp bl, 1
je 0x413ff9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.stemp.vbs
call fcn.0045e4b0
mov byte [ebp - 4], 0x17
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5c], esp
push 0x48d2ac
call fcn.0045e4b0
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 5
mov edx, 0x86
lea ecx, [ebp - 0x4c]
call fcn.00401380
add esp, 0x30
mov byte [ebp - 4], 0x19
push 0x48d1bc
lea ecx, [ebp - 0x38]
call fcn.0045fcf0
mov byte [ebp - 4], 0x1a
push str.cscript___NOLOGO
lea ecx, [ebp - 0x34]
call fcn.0045fcf0
mov byte [ebp - 4], 0x1b
mov bl, 1
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x50]
call fcn.0045f3b0
mov byte [ebp - 4], 0x1c
mov ecx, esp
mov dword [ebp - 0x60], esp
lea edi, [ebp - 0x38]
push edi
mov edx, eax
call fcn.0045f3b0
add esp, 4
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1c
mov dl, bl
lea ecx, [ebp - 0x1c]
call fcn.004642f0
add esp, 4
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4133b2
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4133d4
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4133f6
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov dword [ebp - 0x60], esp
mov ebx, esp
mov dword [ebp - 0x5c], ebx
mov esi, dword [ebp - 0x1c]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413421
cmp ecx, dword [esi - 0x10]
jne 0x413421
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x41344b
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4143a8
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov dword [ebx], eax
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x26
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.unableToConnectCiscoVPN_KB_11311_machine_details
call fcn.0045fcf0
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x23
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
mov edi, dword [ebp - 0x1c]
mov ebx, edi
mov dword [ebp - 0x54], ebx
xor esi, esi
mov dword [ebp - 0x3c], esi
mov ecx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
movzx eax, word [ebx]
test ax, ax
je 0x4134c4
push eax
call ecx
add esp, 4
test eax, eax
je 0x4134b4
test esi, esi
jne 0x4134b9
mov esi, ebx
mov dword [ebp - 0x3c], esi
add ebx, 2
mov dword [ebp - 0x54], ebx
mov edi, dword [ebp - 0x1c]
jmp 0x413488
xor esi, esi
mov dword [ebp - 0x3c], esi
add ebx, 2
mov dword [ebp - 0x54], ebx
mov edi, dword [ebp - 0x1c]
jmp 0x413488
test esi, esi
je 0x413511
sub esi, edi
sar esi, 1
js 0x4143ad
mov ebx, 1
mov ecx, ebx
sub ecx, dword [edi - 4]
mov eax, dword [edi - 8]
sub eax, esi
or eax, ecx
jge 0x4134f1
push esi
lea ecx, [ebp - 0x1c]
call fcn.004032e0
mov edi, dword [ebp - 0x1c]
cmp esi, dword [edi - 8]
jg 0x4143ad
mov dword [edi - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov word [eax + esi*2], cx
mov edi, dword [ebp - 0x1c]
mov ecx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
jmp 0x413516
mov ebx, 1
mov dword [ebp - 0x40], edi
nop dword [eax]
movzx eax, word [edi]
push eax
call ecx
add esp, 4
test eax, eax
je 0x41353b
add edi, 2
mov dword [ebp - 0x40], edi
mov ecx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
jmp 0x413520
mov eax, dword [ebp - 0x1c]
cmp edi, eax
je 0x4135b5
sub edi, eax
sar edi, 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
js 0x4143b7
mov esi, ebx
sub esi, dword [eax - 4]
mov edx, dword [eax - 8]
sub edx, ecx
or edx, esi
jge 0x41356b
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004032e0
mov eax, dword [ebp - 0x1c]
lea esi, [eax + edi*2]
mov dword [ebp - 0x40], esi
mov edx, dword [eax - 0xc]
mov ebx, edx
sub ebx, edi
lea ecx, [ebx*2 + 2]
push ecx
push esi
lea ecx, [edx*2 + 2]
push ecx
push eax
call fcn.00460b50
add esp, 0x10
test ebx, ebx
js 0x4143ad
mov eax, dword [ebp - 0x1c]
cmp ebx, dword [eax - 8]
jg 0x4143ad
mov dword [eax - 0xc], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov word [eax + ebx*2], cx
mov eax, dword [ebp - 0x1c]
push ecx
mov dword [ebp - 0x60], esp
mov ebx, esp
mov dword [ebp - 0x5c], ebx
lea esi, [eax - 0x10]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi + 0xc]
cmp dword [eax], 0
jl 0x4135dd
cmp ecx, dword [esi]
jne 0x4135dd
mov edi, esi
lock inc dword [eax]
jmp 0x41360a
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4143c1
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov edx, dword [esi + 4]
inc edx
push edx
lea eax, [esi + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov dword [ebx], eax
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 0x29
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.unableToConnectCiscoVPN_KB_11311_user_name
call fcn.0045fcf0
mov byte [ebp - 4], 0x2a
mov byte [ebp - 4], 0x23
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
push 0x48fa70
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
push str.AppDataRoamingMicrosoftNetworkConnectionsPbk_rasphone.pbk
lea ecx, [ebp - 0x48]
call fcn.0045fcf0
mov byte [ebp - 4], 0x2b
push 0x48fb30
lea ecx, [ebp - 0x44]
call fcn.0045fcf0
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.0045f3b0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x48]
push ecx
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.0045f3b0
add esp, 8
mov byte [ebp - 4], 0x2e
push dword [eax]
call esi
mov byte [ebp - 4], 0x2f
mov byte [ebp - 4], 0x2d
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4136ba
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x2c
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4136dc
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x31
mov byte [ebp - 4], 0x2b
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4136fe
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x32
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413720
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push str.AppDataRoamingMicrosoftNetworkConnectionsPbk_rasphone.pbk
lea ecx, [ebp - 0x44]
call fcn.0045fcf0
mov byte [ebp - 4], 0x33
push 0x48fb30
lea ecx, [ebp - 0x48]
call fcn.0045fcf0
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x5c]
call fcn.0045f3b0
mov byte [ebp - 4], 0x35
mov ecx, esp
mov dword [ebp - 0x60], esp
lea edx, [ebp - 0x44]
push edx
mov edx, eax
call fcn.0045f3b0
add esp, 4
mov byte [ebp - 4], 0x36
mov byte [ebp - 4], 0x35
call fcn.00467760
add esp, 4
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41379a
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x38
mov byte [ebp - 4], 0x33
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4137bc
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4137de
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.C:ProgramDataMicrosoftNetworkConnectionsPbk_rasphone.pbk
call fcn.0045fcf0
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x23
call fcn.00467760
add esp, 4
test al, al
je 0x413936
push str.Failed_to_delete_VPN_connection
lea ecx, [ebp - 0x20]
call fcn.0045fae0
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x48d10a
call fcn.0045fcf0
mov byte [ebp - 4], 0x3b
push ecx
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x5c], esp
mov esi, dword [ebp - 0x20]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413850
cmp ecx, dword [esi - 0x10]
jne 0x413850
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x41387a
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4143c6
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov byte [ebp - 4], 0x3c
mov byte [ebp - 4], 0x3d
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.Failure
call fcn.0045fcf0
mov byte [ebp - 4], 0x3e
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x24]
call fcn.00463120
add esp, 8
mov dword [ebp - 0x60], esp
mov dword [ebp - 0x5c], esp
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x4138d5
cmp ecx, dword [esi - 0x10]
jne 0x4138d5
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x4138ff
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4143cb
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov byte [ebp - 4], 0x3f
mov byte [ebp - 4], 0x40
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.unableToConnectCiscoVPN_KB_11311
call fcn.0045fcf0
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x23
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
mov byte [ebp - 0x11], 1
mov byte [ebp - 0x13], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.sc_config_vpnagent_startauto
call fcn.0045fcf0
mov byte [ebp - 4], 0x42
mov byte [ebp - 4], 0x23
mov dl, byte [ebp - 0x13]
lea ecx, [ebp - 0x44]
call fcn.004642f0
add esp, 4
mov byte [ebp - 4], 0x43
mov ecx, dword [eax]
mov dword [ebp - 0x48], ecx
mov edi, dword [ecx - 0xc]
mov edx, ecx
mov eax, dword [ebp - 0x18]
sub edx, eax
sar edx, 1
mov dword [ebp - 0x58], edx
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x5c], esi
test edi, edi
js 0x4143d0
test ecx, ecx
jne 0x41398e
xor edi, edi
jmp 0x41399e
push edi
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ecx, SysReAllocString
sub ecx, edi
cmp ecx, esi
jl 0x4143da
add esi, edi
js 0x4143e4
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, edx
jge 0x4139d2
push esi
lea ecx, [ebp - 0x18]
call fcn.004032e0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x4139e2
mov ecx, dword [ebp - 0x48]
push edi
push ecx
lea ecx, [eax + edx*2]
mov edx, edi
call fcn.004031f0
add esp, 8
mov eax, dword [ebp - 0x18]
cmp esi, dword [eax - 8]
jg 0x4143ad
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov word [eax + esi*2], cx
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413a2b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 0x13], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.net_start_vpnagent
call fcn.0045fcf0
mov byte [ebp - 4], 0x45
mov byte [ebp - 4], 0x23
mov dl, byte [ebp - 0x13]
lea ecx, [ebp - 0x60]
call fcn.004642f0
add esp, 4
mov byte [ebp - 4], 0x46
mov ecx, dword [eax]
mov dword [ebp - 0x44], ecx
mov esi, dword [ecx - 0xc]
mov edx, ecx
mov eax, dword [ebp - 0x18]
sub edx, eax
sar edx, 1
mov dword [ebp - 0x58], edx
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x48], edx
test esi, esi
js 0x4143ee
test ecx, ecx
jne 0x413a83
xor edi, edi
jmp 0x413a96
push esi
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov edi, eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x48]
mov ecx, SysReAllocString
sub ecx, edi
cmp ecx, edx
jl 0x4143f8
lea esi, [edx + edi]
test esi, esi
js 0x414402
mov ecx, 1
sub ecx, dword [eax - 4]
mov dword [ebp - 0x5c], ecx
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, dword [ebp - 0x5c]
jge 0x413ad4
push esi
lea ecx, [ebp - 0x18]
call fcn.004032e0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x58]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x413ae1
mov ecx, dword [ebp - 0x44]
push edi
push ecx
lea ecx, [eax + edx*2]
mov edx, edi
call fcn.004031f0
add esp, 8
mov eax, dword [ebp - 0x18]
cmp esi, dword [eax - 8]
jg 0x4143ad
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov word [eax + esi*2], cx
mov byte [ebp - 4], 0x47
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413b2a
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
push str.successfully
lea ecx, [ebp - 0x18]
call fcn.0045f840
test eax, eax
jle 0x413b52
push ecx
push str.denied
lea ecx, [ebp - 0x18]
call fcn.0045f840
test eax, eax
js 0x413c82
push str.Failed_to_chnage_the_service_start_up_type
lea ecx, [ebp - 0x20]
call fcn.0045fae0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push 0x48d10a
call fcn.0045fcf0
mov byte [ebp - 4], 0x48
push ecx
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x60], esp
mov esi, dword [ebp - 0x20]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413b9c
cmp ecx, dword [esi - 0x10]
jne 0x413b9c
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x413bc6
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x41440c
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x49
mov byte [ebp - 4], 0x4a
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.Failure
call fcn.0045fcf0
mov byte [ebp - 4], 0x4b
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x24]
call fcn.00463120
add esp, 8
mov dword [ebp - 0x5c], esp
mov dword [ebp - 0x60], esp
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413c21
cmp ecx, dword [esi - 0x10]
jne 0x413c21
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x413c4b
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x414411
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x4c
mov byte [ebp - 4], 0x4d
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.unableToConnectCiscoVPN_KB_11311
call fcn.0045fcf0
mov byte [ebp - 4], 0x4e
mov byte [ebp - 4], 0x23
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
mov byte [ebp - 0x11], 1
lea ecx, [ebp - 0x2c]
call fcn.004027e0
mov byte [ebp - 4], 0x4f
push ecx
push 0x48fbfc
lea ecx, [ebp - 0x28]
call fcn.0045f840
lea ecx, [ebp - 0x2c]
test eax, eax
js 0x413caa
push str.Cisco_Systems_VPN_Adapter_for_64_bit_Windows
jmp 0x413caf
push str.Cisco_Systems_VPN_Adapter
call fcn.0045fc60
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.STRING
call fcn.0045fcf0
mov byte [ebp - 4], 0x50
push ecx
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x60], esp
mov esi, dword [ebp - 0x2c]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413cf1
cmp ecx, dword [esi - 0x10]
jne 0x413cf1
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x413d1b
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x414416
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x51
mov byte [ebp - 4], 0x52
push ecx
mov dword [ebp - 0x50], esp
mov dword [ebp - 0x60], esp
mov esi, dword [ebp - 0x30]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413d54
cmp ecx, dword [esi - 0x10]
jne 0x413d54
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x413d7e
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x41441b
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x53
mov byte [ebp - 4], 0x54
mov byte [ebp - 4], 0x4f
call fcn.004653f0
add esp, 0xc
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x413ed0
push str.Failed_to_update_the_registry_DisplayName
lea ecx, [ebp - 0x20]
call fcn.0045fc60
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push 0x48d10a
call fcn.0045fcf0
mov byte [ebp - 4], 0x55
push ecx
mov dword [ebp - 0x50], esp
mov dword [ebp - 0x60], esp
mov esi, dword [ebp - 0x20]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413def
cmp ecx, dword [esi - 0x10]
jne 0x413def
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x413e19
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x414420
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x56
mov byte [ebp - 4], 0x57
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.Failure
call fcn.0045fcf0
mov byte [ebp - 4], 0x58
mov byte [ebp - 4], 0x4f
mov ecx, dword [ebp - 0x24]
call fcn.00463120
add esp, 8
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x60], esp
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413e71
cmp ecx, dword [esi - 0x10]
jne 0x413e71
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x413e9b
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x414425
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x59
mov byte [ebp - 4], 0x5a
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.unableToConnectCiscoVPN_KB_11311
call fcn.0045fcf0
mov byte [ebp - 4], 0x5b
mov byte [ebp - 4], 0x4f
mov ecx, dword [ebp - 0x5c]
call fcn.00462c10
add esp, 8
jmp 0x413f21
cmp byte [ebp - 0x11], 0
jne 0x413f21
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x48d10a
call fcn.0045fcf0
mov byte [ebp - 4], 0x5c
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.Necessary_changes_have_been_done.
call fcn.0045fcf0
mov byte [ebp - 4], 0x5d
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push 0x48d168
call fcn.0045fcf0
mov byte [ebp - 4], 0x5e
mov byte [ebp - 4], 0x4f
mov ecx, dword [ebp - 0x24]
call fcn.00463120
add esp, 0xc
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413f43
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x60
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413f65
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x61
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x4c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413f87
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x62
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413fa9
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x63
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413fcb
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x64
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413fed
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 1
jmp 0x414290
push str.Please_contact_IT_Support_for_your_problem.
lea ecx, [ebp - 0x20]
call fcn.0045fc60
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push 0x48d10a
call fcn.0045fcf0
mov byte [ebp - 4], 0xc
push ecx
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x60], esp
mov edi, dword [ebp - 0x20]
add edi, 0xfffffff0
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [edi + 0xc]
cmp dword [eax], 0
jl 0x414043
cmp ecx, dword [edi]
jne 0x414043
mov ebx, edi
lock inc dword [eax]
jmp 0x414070
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x41442a
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov edx, dword [edi + 4]
inc edx
push edx
lea eax, [edi + 0x10]
push eax
lea ecx, [ebx + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.Cisco_VPN_is_not_installed.
call fcn.0045fcf0
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x24]
call fcn.00463120
add esp, 8
mov dword [ebp - 0x5c], esp
mov dword [ebp - 0x60], esp
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [edi + 0xc]
cmp dword [eax], 0
jl 0x4140c5
cmp ecx, dword [edi]
jne 0x4140c5
mov ebx, edi
lock inc dword [eax]
jmp 0x4140f2
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x41442f
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov edx, dword [edi + 4]
inc edx
push edx
lea eax, [edi + 0x10]
push eax
lea ecx, [ebx + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.unableToConnectCiscoVPN_KB_11311
call fcn.0045fcf0
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 5
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414147
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414169
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41418b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0x16
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x4142af
mov ecx, dword [edi]
push edi
jmp 0x4142aa
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4142af
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403880
call fcn.004031e0
call fcn.004031e0
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
push 0x80070057
call fcn.00403880
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
call fcn.004031e0
int3