Function at 0x100425c0
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings
Get common file path
Get program files directory
Get startup folder

Disassembly:
mov ecx, 0x1010bf60
jmp 0x100438d9
mov eax, 0x100cf620
call fcn.10030644
sub esp, 0x434
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x1c], ebx
call fcn.10040e88
xor esi, esi
lea eax, [ebx + 0x2b4]
fldz
mov dword [ebp - 4], esi
mov dword [eax + 8], esi
fstp qword [eax]
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x2d4]
push esi
mov byte [ecx], al
call fcn.1000418b
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x2e4]
mov byte [ebp - 4], 1
push esi
mov byte [ecx], al
call fcn.10002424
mov byte [ebp - 4], 2
mov dword [ebx + 0x2f4], esi
mov byte [ebp - 4], 3
mov dword [ebx + 0x2f8], esi
mov byte [ebp - 4], 4
mov dword [ebx + 0x2fc], esi
mov byte [ebp - 4], 5
mov dword [ebx + 0x300], esi
lea eax, [ebx + 0x308]
mov byte [ebp - 4], 6
mov dword [eax + 8], esi
mov dword [eax], esi
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x318]
mov byte [ebp - 4], 7
push esi
mov byte [ecx], al
call fcn.10002424
mov al, byte [ebp - 0xd]
lea edi, [ebx + 0x340]
mov byte [ebp - 4], 8
push esi
mov ecx, edi
mov byte [edi], al
call fcn.10002424
push 0x100440b5
push 0x10044084
push 0x32
lea eax, [ebx + 0x394]
push 0x58
push eax
mov byte [ebp - 4], 9
call fcn.1003153a
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x14c4]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x14], ecx
and byte [ecx + 8], 0
mov byte [ecx], al
mov al, byte [ebp - 0xd]
mov byte [ecx + 1], al
call fcn.10050bab
mov al, byte [ebp - 0xd]
mov byte [ebp - 4], 0xc
lea ecx, [ebx + 0x34d8]
push esi
mov byte [ecx], al
call fcn.1000418b
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x34e8]
mov byte [ebp - 4], 0xd
push esi
mov byte [ecx], al
call fcn.1000418b
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x34f8]
mov byte [ebp - 4], 0xe
push esi
mov byte [ecx], al
call fcn.1000418b
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x3508]
mov byte [ebp - 4], 0xf
push esi
mov byte [ecx], al
call fcn.1000418b
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x3518]
mov byte [ebp - 4], 0x10
push esi
mov byte [ecx], al
call fcn.10002424
lea eax, [ebx + 0x3528]
mov byte [ebp - 4], 0x11
mov dword [eax + 8], esi
mov dword [eax], esi
lea eax, [ebx + 0x3538]
mov byte [ebp - 4], 0x12
mov dword [eax + 8], esi
mov dword [eax], esi
lea eax, [ebx + 0x3548]
mov byte [ebp - 4], 0x13
mov dword [eax + 8], esi
mov dword [eax], esi
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x355c]
mov byte [ebp - 4], 0x14
push esi
mov byte [ecx], al
call fcn.10002424
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x356c]
mov byte [ebp - 4], 0x15
push esi
mov byte [ecx], al
call fcn.10002424
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x357c]
mov byte [ebp - 4], 0x16
push esi
mov byte [ecx], al
call fcn.10002424
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x3590]
mov byte [ebp - 4], 0x17
push esi
mov byte [ecx], al
call fcn.10002424
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x35a0]
mov byte [ebp - 4], 0x18
push esi
mov byte [ecx], al
call fcn.10002424
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x35b0]
mov byte [ebp - 4], 0x19
push esi
mov byte [ecx], al
call fcn.10002424
mov byte [ebp - 4], 0x1a
mov dword [ebx + 0x35c0], esi
mov dword [ebx + 0x35c8], esi
mov dword [ebx + 0x35cc], esi
mov dword [ebx + 0x35d0], esi
mov dword [ebx + 0x35d4], esi
mov dword [ebx + 0x35d8], esi
mov dword [ebx + 0x35dc], esi
push esi
mov dword [ebx + 0x35e0], esi
push esi
mov dword [ebx + 0x35e4], esi
push esi
mov dword [ebx + 0x35e8], esi
push esi
mov dword [ebx + 0x35f0], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 0x35f4], eax
lea ecx, [ebx + 0x35f8]
mov byte [ebp - 4], 0x1b
call fcn.100440fd
mov byte [ebp - 4], 0x1c
mov dword [ebx + 0x3628], esi
mov byte [ebp - 4], 0x1d
mov dword [ebx + 0x362c], esi
lea ecx, [ebx + 0x3638]
mov byte [ebp - 4], 0x1e
call fcn.100529c5
mov al, byte [ebp - 0xd]
lea ecx, [ebx + 0x365c]
mov byte [ebp - 4], 0x1f
push esi
mov byte [ecx], al
call fcn.1000418b
push esi
push esi
push esi
push esi
mov byte [ebp - 4], 0x20
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 0x36bc], eax
lea eax, [ebx + 0x36c0]
mov byte [ebp - 4], 0x21
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x22
mov dword [ebx + 0x36e4], esi
mov byte [ebp - 4], 0x23
mov dword [ebx + 0x36e8], esi
mov byte [ebp - 4], 0x24
mov dword [ebx + 0x36ec], esi
mov byte [ebp - 4], 0x25
mov dword [ebx + 0x36f0], esi
mov byte [ebp - 4], 0x26
mov dword [ebx + 0x36f4], esi
mov byte [ebp - 4], 0x27
mov dword [ebx], 0x100dce98
call fcn.10041bc1
mov dword [0x1010f670], eax
mov dword [ebx + 0x338], esi
push 0x38
lea eax, [ebx + 0x358]
push esi
push eax
call fcn.10031000
push esi
mov dword [ebx + 0x330], esi
call fcn.10031fe6
push eax
call fcn.10031fb7
mov dword [ebx + 0x2c8], esi
mov dword [ebx + 0x354], esi
push 0x10109650
mov dword [ebx + 0x3630], esi
mov dword [ebx + 0x350], esi
mov dword [ebx + 0x2b0], esi
mov dword [ebx + 0x2d0], esi
mov dword [ebx + 0x2cc], esi
mov dword [ebx + 0x2c0], esi
mov dword [ebx + 0x2c4], esi
call fcn.10030730
add esp, 0x18
lea ecx, [ebx + 0x35a0]
push eax
push 0x10109650
call fcn.100036bc
push 0x10101d34
call fcn.10030730
pop ecx
push eax
push 0x10101d34
mov ecx, edi
call fcn.100036bc
push 0x10101d30
call fcn.10030730
pop ecx
push eax
push 0x10101d30
mov ecx, edi
call fcn.100087df
mov edi, 0x10101d2c
push edi
call fcn.10030730
pop ecx
push eax
push edi
lea ecx, [ebx + 0x340]
call fcn.100087df
push edi
call fcn.10030730
pop ecx
push eax
push edi
lea ecx, [ebx + 0x340]
call fcn.100087df
mov edi, 0x10101d28
push edi
call fcn.10030730
pop ecx
push eax
push edi
lea ecx, [ebx + 0x2e4]
call fcn.100036bc
push 2
mov dword [ebx + 0x35f0], 0x5a
pop edi
push str.vpnclient
mov dword [ebx + 0x35d8], edi
call fcn.10030730
pop ecx
push eax
push str.vpnclient
lea ecx, [ebx + 0x35b0]
call fcn.100036bc
mov dword [ebx + 0x33c], esi
mov dword [ebx + 0x34d4], esi
mov dword [ebx + 0x36fc], esi
mov dword [ebx + 0x3700], esi
mov dword [ebx + 0x14], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x35d4], edi
and byte [ebx + 0x32c], 0
mov dword [ebx + 0x358c], edi
mov dword [ebx + 0x328], esi
mov dword [ebx + 0x35c0], esi
mov dword [ebx + 0x3690], esi
mov dword [ebx + 0x3694], esi
mov dword [ebx + 0x35c8], esi
push 1
mov dword [ebx + 0x35cc], esi
mov dword [ebx + 0x35d0], esi
pop eax
mov dword [ebx + 0x35dc], 0x12c
and byte [ebx + 0x35ec], 0
mov dword [ebx + 0x36dc], eax
mov dword [ebx + 0x36e0], eax
push esi
lea eax, [ebp - 0x440]
push 0x1a
push eax
push esi
mov dword [ebx + 0x36f8], esi
mov dword [ebx + 0x36d8], 3
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 8
mov esi, str.SeDebugPrivilege
pop ecx
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x40]
push ecx
push eax
call fcn.10043708
pop ecx
test eax, eax
pop ecx
jne 0x10043e19
push eax
push eax
sub esp, 0x10
lea eax, [ebp - 0xd]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
push 0x10101ce8
call fcn.10003536
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x27
push eax
call fcn.10041dd8
add esp, 0x14
mov ecx, eax
mov byte [ebp - 4], 0x29
call fcn.10003ab9
push eax
call fcn.100c5aaa
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x27
test ecx, ecx
je 0x10043e19
call fcn.10002801
lea eax, [ebp - 0x440]
lea esi, [ebx + 0x2f4]
push eax
mov ecx, esi
call fcn.10008984
push str._network.dat
lea ecx, [ebp - 0x14]
call fcn.100039ab
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x2a
call fcn.10003a64
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x27
test ecx, ecx
je 0x10043e59
call fcn.10002801
mov esi, 0x10109650
push esi
call fcn.10030730
pop ecx
push eax
push esi
lea ecx, [ebx + 0x3518]
call fcn.100036bc
and dword [ebx + 0x3634], 0
push 0x64
pop esi
push esi
call fcn.100c0da0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov byte [ebp - 4], 0x2b
je 0x10043eb1
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.VpnClientCheck
call fcn.10002736
mov ecx, dword [ebp - 0x14]
push 0x10044fa2
mov byte [ebp - 4], 0x2b
call fcn.10005cb6
jmp 0x10043eb3
xor eax, eax
mov byte [ebp - 4], 0x27
push ebx
mov ecx, eax
mov dword [ebx + 0x36a0], eax
call fcn.10057620
push esi
call fcn.100c0da0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov byte [ebp - 4], 0x2d
je 0x10043efa
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.LoginInHelper
call fcn.10002736
mov ecx, dword [ebp - 0x14]
push 0x10044556
mov byte [ebp - 4], 0x2d
call fcn.10005cb6
jmp 0x10043efc
xor eax, eax
mov byte [ebp - 4], 0x27
push esi
mov dword [ebx + 0x36a4], eax
call fcn.100c0da0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov byte [ebp - 4], 0x2f
je 0x10043f3b
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.GetServerListHelper
call fcn.10002736
mov ecx, dword [ebp - 0x14]
push 0x1004455f
mov byte [ebp - 4], 0x2f
call fcn.10005cb6
jmp 0x10043f3d
xor eax, eax
mov byte [ebp - 4], 0x27
push esi
mov dword [ebx + 0x36a8], eax
call fcn.100c0da0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov byte [ebp - 4], 0x31
je 0x10043f7c
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PreRouteHelper
call fcn.10002736
mov ecx, dword [ebp - 0x14]
push 0x10044915
mov byte [ebp - 4], 0x31
call fcn.10005cb6
jmp 0x10043f7e
xor eax, eax
mov byte [ebp - 4], 0x27
push esi
mov dword [ebx + 0x36ac], eax
call fcn.100c0da0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov byte [ebp - 4], 0x33
je 0x10043fbd
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Ticket
call fcn.10002736
mov ecx, dword [ebp - 0x14]
push 0x10044568
mov byte [ebp - 4], 0x33
call fcn.10005cb6
jmp 0x10043fbf
xor eax, eax
mov byte [ebp - 4], 0x27
push ebx
mov ecx, eax
mov dword [ebx + 0x36b0], eax
call fcn.10057620
push esi
call fcn.100c0da0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov byte [ebp - 4], 0x35
je 0x10044006
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.OpenVpnCheckHelper
call fcn.10002736
mov ecx, dword [ebp - 0x14]
push 0x1004487c
mov byte [ebp - 4], 0x35
call fcn.10005cb6
jmp 0x10044008
xor eax, eax
mov byte [ebp - 4], 0x27
push esi
mov dword [ebx + 0x36b4], eax
call fcn.100c0da0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov byte [ebp - 4], 0x37
je 0x10044047
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x100fb574
call fcn.10002736
mov ecx, dword [ebp - 0x14]
push 0x100445ca
mov byte [ebp - 4], 0x37
call fcn.10005cb6
jmp 0x10044049
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov byte [ebp - 4], 0x27
or dword [ebp - 4], 0xffffffff
mov dword [ebx + 0x36b8], eax
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret