Function at 0x41b7c0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 1
mov esi, ecx
call fcn.0042c969
push 0x208
call fcn.0041f7ba
add esp, 4
mov edi, eax
push 0x208
call fcn.0041f7ba
mov ecx, dword [esi + 0xa8]
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
test ecx, ecx
jne 0x41b80a
push 0x5b1bb8
jmp 0x41b814
cmp ecx, 1
jne 0x41b822
push 0x5b1bc0
push 0x104
push edi
call fcn.0054b04d
add esp, 0xc
push edi
push str.Protocol
push str.SOFTWAREHNCSharedHncUpdate
push ecx
call fcn.0041a820
cmp byte [esi + 0x4dd], 1
jne 0x41b87c
cmp byte [esi + 0x4dc], 1
jne 0x41b84c
push 0x5adca8
jmp 0x41b86c
mov eax, dword [esi + 0x4e0]
cmp dword [eax - 4], 1
jle 0x41b866
push dword [eax - 0xc]
lea ecx, [esi + 0x4e0]
call fcn.00405590
push dword [esi + 0x4e0]
push str.Path
push str.SOFTWAREHNCSharedHncUpdate_protocol_tcp
push ecx
call fcn.0041a820
mov eax, dword [esi + 0x194]
cmp dword [eax - 4], 1
jle 0x41b896
push dword [eax - 0xc]
lea ecx, [esi + 0x194]
call fcn.00405590
push dword [esi + 0x194]
push str.Path
push str.SOFTWAREHNCSharedHncUpdate_protocol_ftp
push ecx
call fcn.0041a820
mov eax, dword [esi + 0x198]
cmp dword [eax - 4], 1
jle 0x41b8c6
push dword [eax - 0xc]
lea ecx, [esi + 0x198]
call fcn.00405590
push dword [esi + 0x198]
push str.User
push str.SOFTWAREHNCSharedHncUpdate_protocol_ftp
push ecx
call fcn.0041a820
push 0x416
call fcn.0041f7ba
add esp, 4
mov dword [esp + 0xc], eax
push 0x416
call fcn.0041f7ba
mov ecx, dword [esi + 0x19c]
add esp, 4
mov ebx, eax
push ecx
mov ecx, dword [ecx - 0xc]
inc ecx
push ecx
push dword [esp + 0x14]
call fcn.0054b04d
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, ebx
call fcn.00403cc0
mov eax, dword [esi + 0x19c]
mov ecx, 0x5adca8
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41b956
test dx, dx
je 0x41b952
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41b956
add eax, 4
add ecx, 4
test dx, dx
jne 0x41b930
xor eax, eax
jmp 0x41b95b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41b96f
push 0x5adca8
push 1
push ebx
call fcn.0054b04d
add esp, 0xc
push ebx
push str.Pass
push str.SOFTWAREHNCSharedHncUpdate_protocol_ftp
push ecx
call fcn.0041a820
mov eax, dword [esi + 0x4d4]
push eax
mov eax, dword [eax - 0xc]
inc eax
push eax
push dword [esp + 0x14]
call fcn.0054b04d
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, ebx
call fcn.00403cc0
mov eax, dword [esi + 0x4d4]
mov ecx, 0x5adca8
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41b9d6
test dx, dx
je 0x41b9d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41b9d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x41b9b0
xor eax, eax
jmp 0x41b9db
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41b9ef
push 0x5adca8
push 1
push ebx
call fcn.0054b04d
add esp, 0xc
push ebx
push 0x5b1ce8
push str.SOFTWAREHNCSharedHncUpdate_protocol_ftp
push ecx
call fcn.0041a820
cmp byte [esi + 0x4dc], 1
je 0x41ba24
mov eax, dword [esi + 0x1a4]
cmp eax, 1
je 0x41ba24
test eax, eax
jne 0x41ba8b
mov edi, str.Manual
mov ebx, 0x5adca8
jmp 0x41ba8f
lea eax, [esp + 0xc]
mov edi, str.Auto
push eax
push 0xf003f
push 0
push str.SOFTWAREHNCSharedHncUpdateHncUtils_NEOHncUpdate
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41ba65
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x14]
push str.HncCheck96.exe
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x41ba8f
lea eax, [esp + 0xc]
mov ecx, str.Path
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0041a770
mov ebx, dword [esp + 0x10]
push str.HncCheck96.exe
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x41ba8f
mov ebx, dword [esp + 0x14]
push edi
push str.CycleType
push str.SOFTWAREHNCSharedHncUpdate
push ecx
call fcn.0041a820
push ebx
push str.HncUpdate96
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push ecx
call fcn.0041a820
mov eax, dword [esi + 0x4d8]
cmp dword [eax - 4], 1
jle 0x41bacb
push dword [eax - 0xc]
lea ecx, [esi + 0x4d8]
call fcn.00405590
push dword [esi + 0x4d8]
push str.DownloadPath
push str.SOFTWAREHNCSharedHncUpdate
push ecx
call fcn.0041a820
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret