Function at 0x468859
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x99c
mov eax, dword [0x4d82d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x954], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x960], eax
mov eax, dword [ebp + 0x10]
mov ebx, 0x103
xor esi, esi
push ebx
mov dword [ebp - 0x96c], eax
lea eax, [ebp - 0x637]
push esi
push eax
mov dword [ebp - 0x95c], esi
mov byte [ebp - 0x638], 0
call fcn.00401f80
add esp, 0xc
push ebx
lea eax, [ebp - 0x217]
push esi
push eax
mov byte [ebp - 0x218], 0
call fcn.00401f80
add esp, 0xc
push ebx
lea eax, [ebp - 0x52f]
push esi
push eax
mov byte [ebp - 0x530], 0
call fcn.00401f80
add esp, 0xc
push ebx
lea eax, [ebp - 0x73f]
push esi
push eax
mov byte [ebp - 0x740], 0
call fcn.00401f80
add esp, 0xc
push ebx
lea eax, [ebp - 0x31f]
push esi
push eax
mov byte [ebp - 0x320], 0
call fcn.00401f80
add esp, 0xc
push ebx
lea eax, [ebp - 0x427]
push esi
push eax
mov byte [ebp - 0x428], 0
call fcn.00401f80
add esp, 0xc
push ebx
lea eax, [ebp - 0x94f]
push esi
push eax
mov byte [ebp - 0x950], 0
call fcn.00401f80
add esp, 0xc
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x998]
push ebx
mov dword [ebp - 0x99c], esi
rep stosd dword es:[edi], eax
mov byte [ebp - 0x110], al
lea eax, [ebp - 0x10f]
push esi
push eax
mov dword [ebp - 0x978], esi
mov dword [ebp - 0x968], esi
call fcn.00401f80
mov edx, dword [ebp - 0x954]
add esp, 0xc
call fcn.00439c56
test eax, eax
jne 0x46902c
mov edx, dword [ebp - 0x960]
call fcn.00439c56
test eax, eax
jne 0x46902c
push dword [ebp - 0x954]
lea edi, [ebx + 1]
mov ecx, edi
lea eax, [ebp - 0x320]
call fcn.00438b01
pop ecx
mov ecx, eax
call fcn.00439aca
mov eax, ecx
push eax
mov ecx, edi
lea eax, [ebp - 0x428]
call fcn.00438b01
pop ecx
mov esi, eax
call fcn.0043897b
mov ecx, esi
call fcn.0046556d
test eax, eax
jne 0x4689e9
mov eax, esi
push ebx
push eax
push eax
call fcn.00465e24
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x950]
call fcn.00465c02
pop ecx
lea eax, [ebp - 0x95c]
push eax
push 0x20019
xor esi, esi
push esi
push str.Network
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x468a30
push dword [ebp - 0x95c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x468a32
xor eax, eax
mov dword [ebp - 0x964], esi
mov dword [ebp - 0x974], esi
mov dword [ebp - 0x97c], esi
cmp eax, esi
je 0x468ea6
mov dword [ebp - 0x958], 0x41
movsx eax, byte [ebp - 0x958]
push eax
push str.Network_c
mov dword [ebp - 0x970], eax
lea eax, [ebp - 0x638]
push edi
push eax
call fcn.004392d1
add esp, 0x10
lea eax, [ebp - 0x95c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x638]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x468e82
push edi
lea eax, [ebp - 0x218]
push esi
push eax
mov dword [ebp - 0x968], ebx
call fcn.00401f80
add esp, 0xc
lea eax, [ebp - 0x968]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x978]
push eax
push esi
push str.RemotePath
push dword [ebp - 0x95c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x218]
call fcn.00439803
mov esi, edx
call fcn.00439757
mov eax, esi
push str.tamspos
push eax
call fcn.004395ea
pop ecx
pop ecx
test eax, eax
jne 0x468b16
mov eax, esi
push 0x4b9d38
push eax
call fcn.004395ea
pop ecx
pop ecx
test eax, eax
je 0x468b20
mov dword [ebp - 0x974], 1
push edi
lea eax, [ebp - 0x530]
push 0
push eax
mov dword [ebp - 0x968], ebx
call fcn.00401f80
add esp, 0xc
lea eax, [ebp - 0x968]
push eax
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x978]
push eax
push 0
push str.UserName
push dword [ebp - 0x95c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x530]
call fcn.00439803
mov esi, edx
call fcn.00439757
push dword [ebp - 0x95c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x95c], 0
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
lea eax, [ebp - 0x740]
call fcn.00438b01
pop ecx
mov ecx, eax
call fcn.00439aca
lea eax, [ebp - 0x320]
push eax
mov eax, ecx
push eax
call fcn.00401811
pop ecx
pop ecx
test eax, eax
je 0x468bec
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x740]
push eax
call fcn.00401811
pop ecx
pop ecx
test eax, eax
je 0x468bec
lea eax, [ebp - 0x950]
push eax
lea eax, [ebp - 0x740]
push eax
call fcn.00401811
pop ecx
pop ecx
test eax, eax
jne 0x468e80
push dword [ebp - 0x960]
inc dword [ebp - 0x964]
lea eax, [ebp - 0x530]
push eax
call fcn.00401811
pop ecx
pop ecx
test eax, eax
je 0x468e80
lea esi, [ebp - 0x530]
call fcn.0043897b
push dword [ebp - 0x960]
mov eax, esi
push eax
call fcn.00401811
pop ecx
pop ecx
test eax, eax
je 0x468e80
push dword [ebp - 0x970]
lea eax, [ebp - 0x638]
push 0x4b9d4c
push edi
push eax
call fcn.004392d1
add esp, 0x10
lea eax, [ebp - 0x320]
push eax
call fcn.00464428
lea eax, [ebp - 0x218]
push eax
call fcn.00464428
lea eax, [ebp - 0x638]
push eax
call fcn.00464428
lea eax, [ebp - 0x320]
push eax
call fcn.00464428
lea eax, [ebp - 0x218]
push eax
call fcn.00464428
push dword [ebp - 0x954]
call fcn.00464428
push 0x4d9528
push 0x4b9d50
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.004392d1
push str._tmp
push dword [ebp - 0x954]
call fcn.004395ea
add esp, 0x18
test eax, eax
jne 0x468cd9
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x954]
call fcn.004395ea
pop ecx
pop ecx
test eax, eax
je 0x468d2a
lea eax, [ebp - 0x320]
push eax
mov ecx, edi
lea eax, [ebp - 0x110]
call fcn.00438b01
pop ecx
mov ecx, str.tamspos
mov ebx, eax
call fcn.0043ad3a
mov eax, ebx
push eax
call fcn.00464428
lea eax, [ebp - 0x320]
push eax
mov ecx, edi
mov eax, ebx
call fcn.00438b01
pop ecx
mov ecx, str.client
call fcn.0043ad3a
mov eax, ebx
push eax
call fcn.00464428
mov ebx, 0x103
push 0x20
lea eax, [ebp - 0x99c]
push 0
push eax
call fcn.00401f80
mov esi, dword [sym.imp.MPR.dll_WNetAddConnection2A]
and dword [ebp - 0x980], 0
add esp, 0xc
push 0x81
push dword [ebp - 0x960]
lea eax, [ebp - 0x638]
push dword [ebp - 0x96c]
mov dword [ebp - 0x98c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x988], eax
lea eax, [ebp - 0x99c]
push eax
mov dword [ebp - 0x998], 1
call esi
test eax, eax
je 0x468e6b
mov edx, dword [ebp - 0x988]
call fcn.00439c56
test eax, eax
jne 0x468e30
push 0x4b9d38
push dword [ebp - 0x988]
call fcn.004395ea
pop ecx
pop ecx
test eax, eax
je 0x468e30
push ebx
lea eax, [ebp - 0x847]
push 0
push eax
mov byte [ebp - 0x848], 0
call fcn.00401f80
add esp, 0xc
push dword [ebp - 0x988]
mov ecx, edi
lea eax, [ebp - 0x848]
call fcn.00438b01
pop ecx
push 0
push str._tamspos
push 0x4b9d38
push edi
push eax
call fcn.0043a534
add esp, 0x14
push 0x81
push dword [ebp - 0x960]
lea eax, [ebp - 0x848]
push dword [ebp - 0x96c]
mov dword [ebp - 0x988], eax
lea eax, [ebp - 0x99c]
push eax
call esi
test eax, eax
lea eax, [ebp - 0x218]
je 0x468e51
mov dword [ebp - 0x988], eax
push dword [ebp - 0x96c]
mov cl, byte [ebp - 0x958]
push dword [ebp - 0x960]
lea edx, [ebp - 0x99c]
call fcn.00467b47
pop ecx
pop ecx
jmp 0x468e76
push dword [ebp - 0x988]
mov ecx, edi
call fcn.00438b01
lea eax, [ebp - 0x218]
pop ecx
mov dword [ebp - 0x988], eax
mov cl, byte [ebp - 0x958]
call fcn.00468849
mov dword [ebp - 0x97c], 1
xor esi, esi
inc dword [ebp - 0x958]
cmp dword [ebp - 0x958], 0x5a
jle 0x468a56
cmp dword [ebp - 0x964], esi
jle 0x468ea6
cmp dword [ebp + 0x14], esi
je 0x46901f
mov eax, 0x21e88e
push 1
mov ebx, eax
mov esi, eax
call fcn.004678c5
mov dword [ebp - 0x958], eax
pop ecx
lea eax, [ebp - 0x320]
push eax
call fcn.00464428
push dword [ebp - 0x954]
mov dword [ebp - 0x970], eax
call fcn.00464428
cmp dword [ebp + 0x14], 0
mov dword [ebp - 0x964], eax
je 0x468fe8
cmp dword [ebp - 0x974], 0
jne 0x468fe8
push 0x4d9528
push 0x4b9d50
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.004392d1
push str._tmp
push dword [ebp - 0x954]
call fcn.004395ea
add esp, 0x18
test eax, eax
jne 0x468f41
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x954]
call fcn.004395ea
pop ecx
pop ecx
test eax, eax
je 0x468fe8
lea eax, [ebp - 0x320]
push eax
mov ecx, edi
lea eax, [ebp - 0x110]
call fcn.00438b01
pop ecx
mov ecx, str.client
mov ebx, eax
call fcn.0043ad3a
mov eax, ebx
push eax
call fcn.00464428
mov esi, eax
lea eax, [ebp - 0x320]
push eax
mov ecx, edi
mov eax, ebx
call fcn.00438b01
pop ecx
mov ecx, str.tamspos
call fcn.0043ad3a
mov eax, ebx
push eax
call fcn.00464428
mov ebx, eax
test ebx, ebx
je 0x468f99
test esi, esi
jne 0x468fe8
push 0x20
xor edi, edi
lea eax, [ebp - 0x99c]
push edi
push eax
call fcn.00401f80
add esp, 0xc
xor eax, eax
inc eax
push eax
push dword [ebp - 0x960]
mov dword [ebp - 0x998], eax
push dword [ebp - 0x96c]
lea eax, [ebp - 0x99c]
lea ecx, [ebp - 0x110]
push eax
mov dword [ebp - 0x98c], edi
mov dword [ebp - 0x988], ecx
mov dword [ebp - 0x980], edi
call dword [sym.imp.MPR.dll_WNetAddConnection2A]
xor eax, eax
cmp dword [ebp - 0x970], eax
je 0x469006
cmp dword [ebp - 0x964], eax
je 0x469006
cmp ebx, eax
je 0x469006
cmp esi, eax
je 0x469006
xor edi, edi
jmp 0x469009
xor edi, edi
inc edi
cmp dword [ebp - 0x958], eax
jle 0x469019
push 2
call fcn.004678c5
pop ecx
test edi, edi
jne 0x469027
xor esi, esi
cmp dword [ebp - 0x97c], esi
je 0x46902c
xor eax, eax
inc eax
jmp 0x46902e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret