Function at 0x41140c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff560
mov eax, 0x44bcb0
push ebx
push esi
push edi
call fcn.0042c210
mov byte [ebp - 0xcd], 0
mov word [ebp - 0xb8], 8
xor edx, edx
xor ecx, ecx
mov dword [ebp - 4], edx
xor eax, eax
inc dword [ebp - 0xac]
mov word [ebp - 0xb8], 0x14
mov word [ebp - 0xb8], 0x20
mov dword [ebp - 8], ecx
inc dword [ebp - 0xac]
mov word [ebp - 0xb8], 0x14
mov word [ebp - 0xb8], 0x2c
mov dword [ebp - 0xc], eax
inc dword [ebp - 0xac]
xor edx, edx
mov word [ebp - 0xb8], 0x14
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xd8], 0x447564
jmp 0x411500
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ecx]
push eax
call fcn.0042bda0
pop ecx
mov edi, eax
xor ebx, ebx
mov eax, dword [ebp - 0xd8]
mov esi, eax
jmp 0x4114e1
push edi
mov eax, dword [ebp + 0x10]
add eax, ebx
push eax
mov edx, dword [esi]
push edx
call fcn.0042bf2c
add esp, 0xc
test eax, eax
jne 0x4114e0
mov byte [ebp - 0xcd], 1
cmp dword [esi - 4], 0xae5
jne 0x4114ea
mov byte [0x46a87e], 1
jmp 0x4114ea
inc ebx
mov ecx, dword [ebp + 0xc]
sub ecx, edi
cmp ebx, ecx
jl 0x4114b1
cmp byte [ebp - 0xcd], 0
jne 0x41150e
inc dword [ebp - 0xcc]
add dword [ebp - 0xd8], 8
mov eax, dword [ebp - 0xcc]
cmp eax, dword [0x44755c]
jl 0x411494
cmp byte [ebp - 0xcd], 0
jne 0x411566
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0xac]
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
pop eax
mov edx, dword [ebp - 0xc8]
mov dword fs:[0], edx
jmp 0x41253a
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ecx*8 + 0x447560]
sub eax, 0x8ea
je 0x411586
sub eax, 0x17a
je 0x411592
jmp 0x41162f
mov byte [ebp - 0xce], 0
jmp 0x411636
lea edx, [ebp - 0x9d8]
push edx
lea ecx, [ebp - 0x8d8]
push ecx
lea eax, [ebp - 0x8d8]
push eax
lea edx, [ebp - 0x8d8]
push edx
mov ecx, dword [0x46a89c]
push ecx
call fcn.0042de18
add esp, 0x14
push str..htm
lea eax, [ebp - 0x9d8]
push eax
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x41161d
push str..html
lea edx, [ebp - 0x9d8]
push edx
call fcn.0042bf74
add esp, 8
test eax, eax
jne 0x41161d
push str..hta
lea ecx, [ebp - 0x9d8]
push ecx
call fcn.0042bf74
add esp, 8
test eax, eax
jne 0x41161d
push str..htt
lea eax, [ebp - 0x9d8]
push eax
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x411626
mov byte [ebp - 0xce], 0
jmp 0x411636
mov byte [ebp - 0xce], 1
jmp 0x411636
mov byte [ebp - 0xce], 1
xor edx, edx
cmp byte [ebp - 0xce], 0
jne 0x411642
inc edx
push edx
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax*8 + 0x447560]
push edx
call fcn.00401410
add esp, 0xc
dec eax
je 0x4116af
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0xac]
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
pop eax
mov edx, dword [ebp - 0xc8]
mov dword fs:[0], edx
jmp 0x41253a
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ecx*8 + 0x447560]
sub eax, 0x8ea
je 0x4116e7
sub eax, 0x17a
je 0x411780
sub eax, 0x13
je 0x411bda
sub eax, 0x98
je 0x411f26
jmp 0x412474
cmp byte [ebp + 0x14], 0
jne 0x4116f5
cmp ebx, 0x1000
jge 0x4116fd
mov dword [0x46b1c4], ebx
jmp 0x41171f
push 2
mov edx, ebx
neg edx
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e350
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.0042e3c4
pop ecx
mov dword [0x46b1c4], eax
mov edx, dword [ebp + 8]
push edx
call fcn.00418690
pop ecx
inc eax
jne 0x4124e5
or eax, 0xffffffff
mov edx, 2
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0xac]
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
pop eax
mov edx, dword [ebp - 0xc8]
mov dword fs:[0], edx
jmp 0x41253a
mov dl, 1
mov eax, dword [0x419624]
call fcn.00419724
mov dword [ebp - 0xd4], eax
mov edx, reloc.DZIP32.DLL_Ordinal_1
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + 0x18], 0x20019
mov eax, dword [ebp - 0xd4]
call fcn.00438624
mov word [ebp - 0xb8], 0x38
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea eax, [ebp - 0x10]
call fcn.0043862c
inc dword [ebp - 0xac]
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [ebp - 0xd4]
call fcn.0041982c
push eax
dec dword [ebp - 0xac]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004386a0
pop ecx
test cl, cl
je 0x411893
mov word [ebp - 0xb8], 0x44
mov word [ebp - 0xb8], 0x50
mov edx, str.ClassicViewState
lea eax, [ebp - 0x14]
call fcn.0043862c
inc dword [ebp - 0xac]
mov edx, dword [eax]
mov ecx, 1
mov eax, dword [ebp - 0xd4]
call fcn.00419dfc
dec dword [ebp - 0xac]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0xb8], 0x14
mov eax, dword [ebp - 0xd4]
call fcn.00419794
mov ebx, dword [ebp - 0xd4]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x411886
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov word [ebp - 0xb8], 0x68
mov edx, 3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0xb8], 0x5c
cmp word [ebp - 0xb6], 0
je 0x4118c4
ret
mov ebx, dword [ebp - 0xd4]
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x4118c4
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
mov word [ebp - 0xb8], 0x80
mov edx, 3
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0xb8], 0x74
push str.Kernel32
push 0x44b71c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.dllfileShell
push Ordinal_1
call fcn.00418170
add esp, 8
push str.dllfileShellEx
push Ordinal_1
call fcn.00418170
add esp, 8
push str.dllfileScriptEngine
push Ordinal_1
call fcn.00418170
add esp, 8
push str.dllfileScriptHostEncode
push Ordinal_1
call fcn.00418170
add esp, 8
cmp byte [ebp - 0xce], 0
je 0x411998
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
test eax, eax
je 0x411948
mov eax, 0xa64
jmp 0x41194b
or eax, 0xffffffff
push eax
dec dword [ebp - 0xac]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
pop eax
mov edx, dword [ebp - 0xc8]
mov dword fs:[0], edx
jmp 0x41253a
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e350
add esp, 0xc
xor eax, eax
mov dword [0x46b1c4], eax
mov edx, dword [ebp + 8]
push edx
push 0x64
lea ecx, [ebp - 0xaa0]
push ecx
call fcn.0042dc54
add esp, 0xc
lea eax, [ebp - 0xaa0]
push 0x23
push 0x44b7a4
push eax
call fcn.0042c00c
add esp, 0xc
test eax, eax
jne 0x411b13
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0042e350
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x44b7c8
call fcn.0042e118
add esp, 8
push 0
push 0x25
mov eax, dword [ebp + 8]
push eax
call fcn.0042e350
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.0042e3c4
pop ecx
mov dword [0x46b1c4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xaa0]
push ecx
push 0x64
push eax
call fcn.0042dc54
add esp, 0xc
jmp 0x411b13
push 6
push str._HTML_
lea edx, [ebp - 0xaa0]
push edx
call fcn.0042c00c
add esp, 0xc
test eax, eax
jne 0x411a8b
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xaa0]
push ecx
push 0x64
push eax
call fcn.0042dc54
add esp, 0xc
lea edx, [ebp - 0xaa0]
push 0x23
push str._BODY_onload_vbscript:KJ_start____
push edx
call fcn.0042c00c
add esp, 0xc
test eax, eax
je 0x411b20
jmp 0x411aef
push 0x1a
push str._script_languagevbscript_
lea ecx, [ebp - 0xaa0]
push ecx
call fcn.0042c00c
add esp, 0xc
test eax, eax
jne 0x411aef
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xaa0]
push eax
push 0xc8
push edx
call fcn.0042dc54
add esp, 0xc
mov ebx, 0x64
lea eax, [ebp - 0xaa0]
push 0x1b
add eax, ebx
push str.___APPLET_NAMEKJ___guest
push eax
call fcn.0042c00c
add esp, 0xc
test eax, eax
je 0x411ae7
inc ebx
cmp ebx, 0x8c
jl 0x411ac2
cmp ebx, 0x8c
jl 0x411b20
mov edx, dword [ebp + 8]
push edx
call fcn.0042e3c4
pop ecx
mov dword [0x46b1c4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xaa0]
push ecx
push 0x64
push eax
call fcn.0042dc54
add esp, 0xc
mov edx, dword [ebp + 8]
test byte [edx + 0x12], 0x20
je 0x411a3c
mov ecx, dword [ebp + 8]
test byte [ecx + 0x12], 0x20
je 0x411b79
or eax, 0xffffffff
mov edx, 2
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0xac]
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
pop eax
mov edx, dword [ebp - 0xc8]
mov dword fs:[0], edx
jmp 0x41253a
mov ecx, dword [ebp + 8]
push ecx
call fcn.00418690
pop ecx
inc eax
jne 0x4124e5
or eax, 0xffffffff
mov edx, 2
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0xac]
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
pop eax
mov edx, dword [ebp - 0xc8]
mov dword fs:[0], edx
jmp 0x41253a
mov dl, 1
mov eax, dword [0x419624]
call fcn.00419724
mov dword [ebp - 0xd4], eax
mov edx, reloc.DZIP32.DLL_Ordinal_1
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + 0x18], 0x20019
mov eax, dword [ebp - 0xd4]
call fcn.00438624
mov word [ebp - 0xb8], 0x8c
mov edx, 0x44b84e
lea eax, [ebp - 0x28]
call fcn.0043862c
inc dword [ebp - 0xac]
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [ebp - 0xd4]
call fcn.0041982c
push eax
dec dword [ebp - 0xac]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004386a0
pop ecx
test cl, cl
je 0x411e81
mov word [ebp - 0xb8], 0x98
mov word [ebp - 0xb8], 0xa4
mov edx, 0x44b859
lea eax, [ebp - 0x2c]
call fcn.0043862c
inc dword [ebp - 0xac]
mov edx, dword [eax]
xor eax, eax
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x30]
inc dword [ebp - 0xac]
mov eax, dword [ebp - 0xd4]
call fcn.00419d84
lea edx, [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.004386d0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0xb8], 0x14
mov eax, dword [ebp - 0xd4]
call fcn.00419794
mov ebx, dword [ebp - 0xd4]
mov dword [ebp - 0x38], ebx
test ebx, ebx
je 0x411d07
mov eax, dword [ebx]
mov dword [ebp - 0x34], eax
mov word [ebp - 0xb8], 0xbc
mov edx, 3
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0xb8], 0xb0
cmp word [ebp - 0xb6], 0
je 0x411d12
ret
mov word [ebp - 0xb8], 0xc8
xor edx, edx
mov dword [ebp - 0x3c], edx
lea ecx, [ebp - 0x3c]
inc dword [ebp - 0xac]
lea edx, [ebp - 4]
mov eax, 0x44b869
call fcn.0043884c
lea eax, [ebp - 0x3c]
push eax
mov edx, 0x44b875
lea eax, [ebp - 0x40]
call fcn.0043862c
inc dword [ebp - 0xac]
xor ecx, ecx
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x44]
inc dword [ebp - 0xac]
lea edx, [ebp - 0x40]
pop eax
call fcn.004386e4
lea edx, [ebp - 0x44]
lea eax, [ebp - 8]
call fcn.004386d0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.004386a0
push str.Signature_Flags_3
cmp dword [ebp - 8], 0
je 0x411db8
mov ecx, dword [ebp - 8]
jmp 0x411dbd
mov ecx, 0x44b8af
push ecx
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
mov word [ebp - 0xb8], 0xd4
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x48], eax
mov eax, 0x44b8b0
inc dword [ebp - 0xac]
lea ecx, [ebp - 0x48]
lea edx, [ebp - 4]
call fcn.0043884c
lea eax, [ebp - 0x48]
push eax
mov edx, 0x44b8bc
lea eax, [ebp - 0x4c]
call fcn.0043862c
inc dword [ebp - 0xac]
xor ecx, ecx
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x50]
inc dword [ebp - 0xac]
lea edx, [ebp - 0x4c]
pop eax
call fcn.004386e4
lea edx, [ebp - 0x50]
lea eax, [ebp - 8]
call fcn.004386d0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004386a0
cmp dword [ebp - 8], 0
je 0x411e6c
mov ecx, dword [ebp - 8]
jmp 0x411e71
mov ecx, 0x44b8ef
push ecx
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00418170
add esp, 8
jmp 0x411eb2
mov ebx, dword [ebp - 0xd4]
mov dword [ebp - 0x58], ebx
test ebx, ebx
je 0x411eb2
mov eax, dword [ebx]
mov dword [ebp - 0x54], eax
mov word [ebp - 0xb8], 0xec
mov edx, 3
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0xb8], 0xe0
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
test eax, eax
je 0x411ed6
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax*8 + 0x447560]
jmp 0x411ed9
or eax, 0xffffffff
push eax
dec dword [ebp - 0xac]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
pop eax
mov edx, dword [ebp - 0xc8]
mov dword fs:[0], edx
jmp 0x41253a
mov dl, 1
mov eax, dword [0x419624]
call fcn.00419724
mov dword [ebp - 0xd4], eax
mov edx, reloc.DZIP32.DLL_Ordinal_1
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + 0x18], 0x20019
mov eax, dword [ebp - 0xd4]
call fcn.00438624
mov word [ebp - 0xb8], 0xf8
mov edx, str.Identities
lea eax, [ebp - 0x5c]
call fcn.0043862c
inc dword [ebp - 0xac]
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [ebp - 0xd4]
call fcn.0041982c
push eax
dec dword [ebp - 0xac]
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004386a0
pop ecx
test cl, cl
je 0x41219a
mov word [ebp - 0xb8], 0x104
mov word [ebp - 0xb8], 0x110
mov edx, str.Default_User_ID
lea eax, [ebp - 0x60]
call fcn.0043862c
inc dword [ebp - 0xac]
mov edx, dword [eax]
xor eax, eax
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0x64]
inc dword [ebp - 0xac]
mov eax, dword [ebp - 0xd4]
call fcn.00419d84
lea edx, [ebp - 0x64]
lea eax, [ebp - 4]
call fcn.004386d0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0xb8], 0x14
mov eax, dword [ebp - 0xd4]
call fcn.00419794
cmp word [ebp - 0xb6], 0
je 0x41202d
ret
mov word [ebp - 0xb8], 0x11c
xor edx, edx
mov dword [ebp - 0x68], edx
lea ecx, [ebp - 0x68]
inc dword [ebp - 0xac]
lea edx, [ebp - 4]
mov eax, 0x44b90b
call fcn.0043884c
lea ecx, [ebp - 0x68]
push ecx
mov edx, str.SoftwareMicrosoftOutlook_Express5.0
lea eax, [ebp - 0x6c]
call fcn.0043862c
inc dword [ebp - 0xac]
xor eax, eax
mov dword [ebp - 0x70], eax
lea edx, [ebp - 0x6c]
inc dword [ebp - 0xac]
lea ecx, [ebp - 0x70]
pop eax
call fcn.004386e4
lea edx, [ebp - 0x70]
lea eax, [ebp - 8]
call fcn.004386d0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.004386a0
push str.Signature_Flags_1
cmp dword [ebp - 8], 0
je 0x4120d3
mov ecx, dword [ebp - 8]
jmp 0x4120d8
mov ecx, 0x44b951
push ecx
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
mov word [ebp - 0xb8], 0x128
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x74], eax
mov eax, str.Identities_
inc dword [ebp - 0xac]
lea ecx, [ebp - 0x74]
lea edx, [ebp - 4]
call fcn.0043884c
lea eax, [ebp - 0x74]
push eax
mov edx, str.SoftwareMicrosoftOutlook_Express5.0_signatures
lea eax, [ebp - 0x78]
call fcn.0043862c
inc dword [ebp - 0xac]
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
lea ecx, [ebp - 0x7c]
inc dword [ebp - 0xac]
lea edx, [ebp - 0x78]
pop eax
call fcn.004386e4
lea edx, [ebp - 0x7c]
lea eax, [ebp - 8]
call fcn.004386d0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004386a0
cmp dword [ebp - 8], 0
je 0x412187
mov ecx, dword [ebp - 8]
jmp 0x41218c
mov ecx, 0x44b991
push ecx
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00418170
add esp, 8
mov eax, dword [ebp - 0xd4]
mov edx, 0x80000002
mov dword [eax + 0x18], 0x2001f
mov eax, dword [ebp - 0xd4]
call fcn.00438624
mov word [ebp - 0xb8], 0x134
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionURLDefaultPrefix
lea eax, [ebp - 0x80]
call fcn.0043862c
inc dword [ebp - 0xac]
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [ebp - 0xd4]
call fcn.0041982c
push eax
dec dword [ebp - 0xac]
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.004386a0
pop ecx
test cl, cl
je 0x412398
mov word [ebp - 0xb8], 0x140
mov word [ebp - 0xb8], 0x14c
mov edx, 0x44b9cf
lea eax, [ebp - 0x84]
call fcn.0043862c
inc dword [ebp - 0xac]
mov edx, dword [eax]
xor eax, eax
mov dword [ebp - 0x88], eax
lea ecx, [ebp - 0x88]
inc dword [ebp - 0xac]
mov eax, dword [ebp - 0xd4]
call fcn.00419d84
lea edx, [ebp - 0x88]
lea eax, [ebp - 0xc]
call fcn.004386d0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x88]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x84]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0xb8], 0x158
mov edx, 0x44b9d0
lea eax, [ebp - 0x8c]
call fcn.0043862c
inc dword [ebp - 0xac]
lea edx, [ebp - 0x8c]
lea eax, [ebp - 0xc]
call fcn.00438788
push eax
dec dword [ebp - 0xac]
lea eax, [ebp - 0x8c]
mov edx, 2
call fcn.004386a0
pop ecx
test cl, cl
je 0x41233d
mov edx, str.http:__
lea eax, [ebp - 0x94]
call fcn.0043862c
inc dword [ebp - 0xac]
mov edx, 0x44b9d8
mov ecx, dword [eax]
lea eax, [ebp - 0x90]
push ecx
mov word [ebp - 0xb8], 0x164
call fcn.0043862c
inc dword [ebp - 0xac]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd4]
pop ecx
call fcn.00419d58
dec dword [ebp - 0xac]
lea eax, [ebp - 0x94]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 0x90]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0xb8], 0x14
mov eax, dword [ebp - 0xd4]
call fcn.00419794
mov ebx, dword [ebp - 0xd4]
mov dword [ebp - 0x9c], ebx
test ebx, ebx
je 0x41238b
mov eax, dword [ebx]
mov dword [ebp - 0x98], eax
mov word [ebp - 0xb8], 0x17c
mov edx, 3
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0xb8], 0x170
cmp word [ebp - 0xb6], 0
je 0x4123d2
ret
mov ebx, dword [ebp - 0xd4]
mov dword [ebp - 0xa4], ebx
test ebx, ebx
je 0x4123d2
mov eax, dword [ebx]
mov dword [ebp - 0xa0], eax
mov word [ebp - 0xb8], 0x194
mov edx, 3
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0xb8], 0x188
push str.AdvancedTab
push 0x44b9e1
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push str.SecurityTab
push str.SoftwarePoliciesMicrosoftInternet_ExplorerControl_Panel
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
test eax, eax
je 0x412424
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax*8 + 0x447560]
jmp 0x412427
or eax, 0xffffffff
push eax
dec dword [ebp - 0xac]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
pop eax
mov edx, dword [ebp - 0xc8]
mov dword fs:[0], edx
jmp 0x41253a
push 0
mov ecx, dword [0x46a898]
push ecx
call fcn.00417790
add esp, 8
test eax, eax
je 0x412498
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax*8 + 0x447560]
jmp 0x41249b
or eax, 0xffffffff
push eax
dec dword [ebp - 0xac]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
pop eax
mov edx, dword [ebp - 0xc8]
mov dword fs:[0], edx
jmp 0x41253a
mov ecx, dword [ebp - 0xcc]
mov edx, 2
mov eax, dword [ecx*8 + 0x447560]
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0xac]
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0xac]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
pop eax
mov edx, dword [ebp - 0xc8]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0xaac]
mov esi, dword [ebp - 0xaa8]
mov ebx, dword [ebp - 0xaa4]
pop ebp
ret