Function at 0x442850
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Query or enumerate registry value
Resolve dns
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x586ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x9ec
mov eax, dword [0x6531f0]
xor eax, esp
mov dword [esp + 0x9e8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6531f0]
xor eax, esp
push eax
lea eax, [esp + 0xa00]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xa08], 0
lea eax, [esp + 0x24]
push eax
call fcn.0040cb50
mov byte [esp + 0xa08], 1
lea ebp, [esi + 0x2c]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x24]
lea edi, [esp + 0x24]
call fcn.0040e9d0
mov ebx, dword [esi + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x65236c], 1
jl 0x4429ea
mov eax, dword [esp + 0x24]
cmp dword [eax - 4], 1
jle 0x4428f1
mov ecx, dword [eax - 0xc]
push ecx
mov edx, edi
push edx
call fcn.00402a30
mov eax, dword [esp + 0x24]
xor edi, edi
xor ecx, ecx
mov word [esp + 0x80], cx
mov ebp, 7
mov ecx, eax
mov dword [esp + 0x94], ebp
mov dword [esp + 0x90], edi
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x442915
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x80]
call fcn.0040e430
mov byte [esp + 0xa08], 2
lea ecx, [esp + 0x124]
call fcn.004257c0
mov byte [esp + 0xa08], 3
mov esi, 0x10
cmp dword [eax + 0x18], esi
jb 0x44295c
mov eax, dword [eax + 4]
jmp 0x44295f
add eax, 4
push ebx
push eax
push str.Connecting_to_MC:__s__i
push str.Reporter::SendReport
push 1
call fcn.004fa3c2
add esp, 0x14
mov byte [esp + 0xa08], 2
cmp dword [esp + 0x13c], esi
jb 0x442996
mov edx, dword [esp + 0x128]
push edx
call fcn.004fdb3f
add esp, 4
mov dword [esp + 0x13c], 0xf
mov dword [esp + 0x138], edi
mov byte [esp + 0x128], 0
mov byte [esp + 0xa08], 1
cmp dword [esp + 0x94], 8
jb 0x4429d2
mov eax, dword [esp + 0x80]
push eax
call fcn.004fdb3f
add esp, 4
xor ecx, ecx
mov dword [esp + 0x94], ebp
mov dword [esp + 0x90], edi
mov word [esp + 0x80], cx
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
or ebp, 0xffffffff
mov dword [esp + 0x54], edi
cmp edi, ebp
jne 0x442a50
cmp dword [0x65236c], 3
jl 0x442a27
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.socket_error____i
push str.Reporter::SendReport
push 3
call fcn.004fa3c2
add esp, 0x10
mov byte [esp + 0xa08], 0
lea ecx, [esp + 0x24]
call fcn.00402750
mov dword [esp + 0xa08], ebp
lea ecx, [esp + 0xa10]
call fcn.00402750
jmp 0x444008
mov edx, 2
push ebx
mov word [esp + 0x148], dx
call dword [sym.imp.WS2_32.dll_htons]
push ecx
mov word [esp + 0x14a], ax
mov eax, esp
mov dword [esp + 0x1c], esp
lea ecx, [esp + 0x28]
push ecx
push eax
call fcn.0040cbb0
mov byte [esp + 0xa0c], 4
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0xa10], 1
call fcn.004060e0
add esp, 8
mov byte [esp + 0xa08], 5
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x148], eax
mov byte [esp + 0xa08], 1
lea ecx, [esp + 0x20]
call fcn.0040ca90
cmp dword [esp + 0x148], ebp
jne 0x442b97
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
lea ecx, [esp + 0x28]
push ecx
push eax
call fcn.0040cbb0
mov byte [esp + 0xa0c], 6
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0xa10], 1
call fcn.004060e0
add esp, 8
mov byte [esp + 0xa08], 7
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
mov byte [esp + 0xa08], 1
lea ecx, [esp + 0x20]
call fcn.0040ca90
test esi, esi
jne 0x442b7c
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [0x65236c], 3
jl 0x442b53
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.gethostbyname_error____i
push str.Reporter::SendReport
push 3
call fcn.004fa3c2
add esp, 0x10
mov byte [esp + 0xa08], 0
lea ecx, [esp + 0x24]
call fcn.00402750
mov dword [esp + 0xa08], ebp
lea ecx, [esp + 0xa10]
call fcn.00402750
jmp 0x444008
movsx eax, word [esi + 0xa]
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
push eax
push edx
lea eax, [esp + 0x150]
push eax
call fcn.00501eb0
add esp, 0xc
push 0x10
lea ecx, [esp + 0x148]
push ecx
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, ebp
jne 0x442bf9
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [0x65236c], 3
jl 0x442bd0
push str.cannot_connect
push str.Reporter::SendReport
push 3
call fcn.004fa3c2
add esp, 0xc
mov byte [esp + 0xa08], 0
lea ecx, [esp + 0x24]
call fcn.00402750
mov dword [esp + 0xa08], ebp
lea ecx, [esp + 0xa10]
call fcn.00402750
jmp 0x444008
push 0x633480
lea edx, [esp + 0xa14]
push edx
call fcn.00445d10
mov eax, dword [0x66b154]
push eax
lea ecx, [esp + 0xa14]
push ecx
call fcn.00445d10
push 0x100000
call fcn.004fe27d
add esp, 4
push 0x100000
mov ebx, eax
push 0
push ebx
call fcn.00501e30
add esp, 8
mov edx, esp
mov dword [esp + 0x1c], esp
lea eax, [esp + 0xa14]
push eax
push edx
call fcn.0040cbb0
mov byte [esp + 0xa0c], 8
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0xa10], 1
call fcn.004060e0
add esp, 8
mov byte [esp + 0xa08], 9
mov ecx, dword [eax]
mov edx, ebx
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x442c80
mov byte [esp + 0xa08], 1
lea ecx, [esp + 0x20]
call fcn.0040ca90
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x442ca0
sub eax, edx
xor edi, edi
cmp dword [0x65236c], 1
mov esi, eax
jl 0x442ccb
push ebx
push str.Send_data:__s
push str.Reporter::SendReport
push 1
call fcn.004fa3c2
add esp, 0x10
xor ebp, ebp
lea ecx, [ecx]
mov eax, dword [esp + 0x54]
push 0
push esi
lea edx, [edi + ebx]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x442cf9
cmp eax, 0xffffffff
je 0x442cf9
add edi, eax
cmp eax, esi
je 0x442cf9
inc ebp
sub esi, eax
cmp ebp, 0xa
jl 0x442cd0
push ebx
call fcn.004fe160
add esp, 4
test edi, edi
je 0x443fa7
cmp byte [esp + 0xa14], 0
je 0x443fa7
mov ebx, dword [esp + 0x54]
lea ecx, [esp + 0x28]
push ecx
call fcn.00442520
mov byte [esp + 0xa08], 0xa
mov edi, 1
cmp dword [0x65236c], edi
jl 0x442daf
push ecx
mov edx, esp
mov dword [esp + 0x1c], esp
lea eax, [esp + 0x2c]
push eax
push edx
call fcn.0040cbb0
mov byte [esp + 0xa0c], 0xb
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0xa10], 0xa
call fcn.004060e0
add esp, 8
mov esi, eax
mov byte [esp + 0xa08], 0xc
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], edi
jle 0x442d88
mov edx, dword [eax + 4]
push edx
push esi
call fcn.0040e950
mov esi, dword [esi]
push esi
push str.Receive_data:__s
push str.Reporter::SendReport
push edi
call fcn.004fa3c2
add esp, 0x10
mov byte [esp + 0xa08], 0xa
lea ecx, [esp + 0x20]
call fcn.0040ca90
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx - 0xc]
test eax, eax
jle 0x443f96
push str.set_keywords:
push ecx
call fcn.0050006e
add esp, 8
test eax, eax
je 0x4430d1
sub eax, dword [esp + 0x28]
sar eax, 1
jne 0x4430d1
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0040cbb0
mov byte [esp + 0xa08], 0xd
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jge 0x442e06
or eax, 0xffffffff
jmp 0x442e23
push 0x632c38
push eax
call fcn.0050006e
add esp, 8
test eax, eax
jne 0x442e1d
or eax, 0xffffffff
jmp 0x442e23
sub eax, dword [esp + 0x14]
sar eax, 1
inc eax
lea ebx, [esp + 0x14]
call fcn.0042ada0
lea edx, [esp + 0xcc]
push edx
call fcn.00432d40
mov byte [esp + 0xa08], 0xe
push ecx
mov esi, esp
mov dword [esp + 0x24], esp
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
mov ecx, ebx
push ecx
push eax
call fcn.0040cbb0
mov byte [esp + 0xa10], 0xf
push esi
mov byte [esp + 0xa14], 0xe
call fcn.004060e0
add esp, 8
mov byte [esp + 0xa0c], 0x10
lea edx, [esp + 0xd0]
push edx
mov byte [esp + 0xa10], 0xe
call fcn.00441940
call fcn.00432600
mov ebx, eax
test ebx, ebx
je 0x4430a6
push ebx
lea ecx, [esp + 0xd0]
call fcn.004376d0
mov eax, dword [esp + 0x11c]
mov ebp, dword [eax]
mov edi, dword [esp + 0x104]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], edi
mov esi, dword [esp + 0x11c]
test edi, edi
je 0x442ed7
cmp edi, dword [esp + 0x104]
je 0x442edc
call fcn.004fe843
cmp ebp, esi
je 0x442fb6
push 0xa7
lea ecx, [esp + 0x159]
push 0
push ecx
mov byte [esp + 0x160], 0
call fcn.00501e30
add esp, 0xc
lea edx, [esp + 0x154]
push edx
test edi, edi
jne 0x442fab
call fcn.004fe843
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x442f24
call fcn.004fe843
push ecx
lea esi, [ebp + 0xc]
lea eax, [esi + 4]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
push ecx
call fcn.00417850
mov byte [esp + 0xa10], 0x11
mov byte [esp + 0xa10], 0xe
call fcn.00429120
add esp, 8
push 0xa8
lea edx, [esp + 0x158]
push edx
test edi, edi
jne 0x442fb2
call fcn.004fe843
cmp ebp, dword [edi + 0x18]
jne 0x442f70
call fcn.004fe843
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push esi
push eax
call fcn.00417850
mov byte [esp + 0xa14], 0x12
mov byte [esp + 0xa14], 0xe
mov ecx, ebx
call fcn.004358a0
lea esi, [esp + 0x18]
call fcn.0043bff0
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
jmp 0x442ec3
mov eax, dword [edi]
jmp 0x442f1a
mov edi, dword [edi]
jmp 0x442f66
lea ecx, [esp + 0x124]
push ecx
call fcn.00417040
mov byte [esp + 0xa08], 0x13
push 0
lea ecx, [esp + 0x128]
call fcn.004194b0
test al, al
je 0x443091
mov ebx, dword [esp + 0x140]
push str.delete_from_keywords_
call fcn.00475230
mov ecx, dword [esp + 0xdc]
sub ecx, dword [esp + 0xd8]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
xor esi, esi
add eax, edx
je 0x44307c
xor ebx, ebx
cmp esi, eax
jb 0x443020
call fcn.004fe843
mov edx, dword [esp + 0xd8]
sub esp, 0x18
mov eax, esp
mov dword [esp + 0x38], esp
lea edi, [ebx + edx]
push eax
call fcn.0041e420
mov byte [esp + 0xa20], 0x14
mov byte [esp + 0xa20], 0x13
lea ecx, [esp + 0x13c]
call fcn.0041b1d0
mov ecx, dword [esp + 0xdc]
sub ecx, dword [esp + 0xd8]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
add ebx, 0x18
cmp esi, eax
jb 0x443020
lea ecx, [esp + 0xe4]
push ecx
lea edx, [esp + 0x128]
push edx
call fcn.0041baa0
mov byte [esp + 0xa08], 0xe
lea eax, [esp + 0x124]
push eax
call fcn.004170a0
mov byte [esp + 0xa08], 0xd
lea ecx, [esp + 0xcc]
push ecx
call fcn.00432db0
mov byte [esp + 0xa08], 0xa
lea ecx, [esp + 0x14]
call fcn.00402750
jmp 0x443f96
lea edx, [esp + 0x7c]
push edx
call fcn.0046c6c0
mov byte [esp + 0xa08], 0x15
mov eax, dword [esp + 0x28]
cmp dword [eax - 4], edi
jle 0x4430fe
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00402a30
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x124]
call fcn.0040c640
mov byte [esp + 0xa08], 0x16
lea edx, [esp + 0x124]
push edx
mov esi, 0x3b
lea edi, [esp + 0x80]
call fcn.00425960
add esp, 4
mov byte [esp + 0xa08], 0x15
lea esi, [esp + 0x124]
call fcn.0042f9c0
mov ecx, dword [esp + 0x8c]
sub ecx, dword [esp + 0x88]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
xor ebp, ebp
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x50], ebp
je 0x443f84
cmp ebp, eax
jb 0x443178
call fcn.004fe843
mov ecx, dword [esp + 0x88]
lea eax, [ebp*8]
sub eax, ebp
cmp dword [ecx + eax*4 + 0x18], 8
lea eax, [ecx + eax*4]
jb 0x443197
mov eax, dword [eax + 4]
jmp 0x44319a
add eax, 4
lea edx, [esp + 0x14]
push edx
mov ecx, eax
call fcn.004026a0
mov byte [esp + 0xa08], 0x17
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x443f2e
jl 0x443212
push str.Quick_Scan
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x443212
sub eax, ecx
sar eax, 1
jne 0x443212
call fcn.00457020
push 0
push 1
push ecx
mov esi, eax
mov eax, esp
mov dword [esp + 0x24], esp
push eax
mov ecx, 0x634068
call fcn.0041bef0
mov byte [esp + 0xa14], 0x18
push esi
mov byte [esp + 0xa18], 0x17
call fcn.0045c2b0
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.Full_Scan
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x44326f
sub eax, ecx
sar eax, 1
jne 0x44326f
call fcn.00457020
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, 0x634084
mov esi, eax
call fcn.0041bef0
mov byte [esp + 0xa14], 0x19
push esi
mov byte [esp + 0xa18], 0x17
call fcn.0045c2b0
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.Custom_Scan
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x44332e
sub eax, ecx
sar eax, 1
jne 0x44332e
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x44]
push eax
call fcn.0040cbb0
mov byte [esp + 0xa08], 0x1a
mov eax, dword [esp + 0x40]
cmp dword [eax - 0xc], 0
jge 0x4432c3
or eax, 0xffffffff
jmp 0x4432e0
push 0x632c38
push eax
call fcn.0050006e
add esp, 8
test eax, eax
jne 0x4432da
or eax, 0xffffffff
jmp 0x4432e0
sub eax, dword [esp + 0x40]
sar eax, 1
inc eax
lea ebx, [esp + 0x40]
call fcn.0042ada0
call fcn.00457020
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
mov edx, ebx
push edx
push ecx
mov esi, eax
call fcn.0040cbb0
mov byte [esp + 0xa14], 0x1b
push esi
mov byte [esp + 0xa18], 0x1a
call fcn.0045c2b0
mov byte [esp + 0xa08], 0x17
mov ecx, ebx
call fcn.00402750
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.Device_Allow
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x443374
sub eax, ecx
sar eax, 1
jne 0x443374
call fcn.00457020
xor cl, cl
call fcn.00460f70
mov eax, dword [0x66b064]
add eax, 0xc0
push eax
call fcn.0046b7d0
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.Device_Block
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x4433bc
sub eax, ecx
sar eax, 1
jne 0x4433bc
call fcn.00457020
mov cl, 1
call fcn.00460f70
mov ecx, dword [0x66b064]
add ecx, 0xc0
push ecx
call fcn.0046b7d0
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.USB_Protection:
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x44382a
sub eax, ecx
sar eax, 1
jne 0x44382a
or eax, 0xffffffff
lea edx, [esp + 0x14]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x3c], eax
push edx
lea eax, [esp + 0x50]
push eax
call fcn.0040cbb0
mov byte [esp + 0xa08], 0x1c
lea ecx, [esp + 0xb4]
push ecx
call fcn.0046c6c0
mov bl, 0x1d
mov byte [esp + 0xa08], bl
mov eax, dword [esp + 0x4c]
cmp dword [eax - 4], 1
jle 0x443442
mov edx, dword [eax - 0xc]
push edx
lea eax, [esp + 0x50]
push eax
call fcn.00402a30
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x124]
call fcn.0040c640
mov byte [esp + 0xa08], 0x1e
lea ecx, [esp + 0x124]
push ecx
mov esi, 0x2c
lea edi, [esp + 0xb8]
call fcn.00425960
add esp, 4
mov byte [esp + 0xa08], bl
cmp dword [esp + 0x13c], 8
jb 0x443493
mov edx, dword [esp + 0x128]
push edx
call fcn.004fdb3f
add esp, 4
mov esi, dword [esp + 0xc0]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x138], eax
mov dword [esp + 0x5c], eax
mov word [esp + 0x128], cx
mov ecx, dword [esp + 0xc4]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x13c], 7
je 0x4437fc
mov dword [esp + 0x60], 0
cmp dword [esp + 0x5c], eax
jb 0x4434f8
call fcn.004fe843
mov esi, dword [esp + 0xc0]
mov ecx, dword [esp + 0x60]
cmp dword [ecx + esi + 0x18], 8
jb 0x443509
mov ecx, dword [ecx + esi + 4]
jmp 0x44350d
lea ecx, [ecx + esi + 4]
lea edx, [esp + 0x34]
push edx
call fcn.004026a0
mov byte [esp + 0xa08], 0x1f
lea ebx, [esp + 0x34]
call fcn.0042c7a0
mov ebx, eax
call fcn.0042c820
lea eax, [esp + 0x64]
push eax
call fcn.0046c6c0
mov byte [esp + 0xa08], 0x20
mov eax, dword [esp + 0x34]
cmp dword [eax - 4], 1
jle 0x44355d
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.00402a30
mov eax, dword [esp + 0x34]
xor ebx, ebx
xor ecx, ecx
mov word [esp + 0x9c], cx
mov ebp, 7
mov ecx, eax
mov dword [esp + 0xb0], ebp
mov dword [esp + 0xac], ebx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x443581
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x9c]
call fcn.0040e430
mov byte [esp + 0xa08], 0x21
mov edx, esi
push edx
mov esi, 0x3a
lea edi, [esp + 0x68]
call fcn.00425960
add esp, 4
mov byte [esp + 0xa08], 0x20
cmp dword [esp + 0xb0], 8
jb 0x4435db
mov eax, dword [esp + 0x9c]
push eax
call fcn.004fdb3f
add esp, 4
mov esi, dword [esp + 0x74]
xor ecx, ecx
mov word [esp + 0x9c], cx
mov ecx, dword [esp + 0x70]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xb0], ebp
mov dword [esp + 0xac], ebx
cmp eax, 2
jne 0x44376a
lea edi, [eax + 0xc]
mov eax, dword [ecx + 0x14]
push str.USB_Protection
call fcn.0040e810
test eax, eax
jne 0x443673
mov ecx, dword [esp + 0x74]
mov esi, dword [esp + 0x70]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 1
ja 0x443658
call fcn.004fe843
mov esi, dword [esp + 0x70]
cmp dword [esi + 0x34], 8
jb 0x443663
mov esi, dword [esi + 0x20]
jmp 0x443666
add esi, 0x20
push esi
call fcn.004fe155
add esp, 4
mov dword [esp + 0x2c], eax
mov esi, dword [esp + 0x74]
mov ecx, dword [esp + 0x70]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x44369b
call fcn.004fe843
mov ecx, dword [esp + 0x70]
mov eax, dword [ecx + 0x14]
push str.delay
mov edi, 5
call fcn.0040e810
test eax, eax
jne 0x4436f7
mov ecx, dword [esp + 0x74]
mov esi, dword [esp + 0x70]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 1
ja 0x4436dc
call fcn.004fe843
mov esi, dword [esp + 0x70]
cmp dword [esi + 0x34], 8
jb 0x4436e7
mov esi, dword [esi + 0x20]
jmp 0x4436ea
add esi, 0x20
push esi
call fcn.004fe155
add esp, 4
mov dword [esp + 0x18], eax
mov esi, dword [esp + 0x74]
mov ecx, dword [esp + 0x70]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x44371f
call fcn.004fe843
mov ecx, dword [esp + 0x70]
mov eax, dword [ecx + 0x14]
push str.password
mov edi, 8
call fcn.0040e810
test eax, eax
jne 0x44376a
mov ecx, dword [esp + 0x74]
sub ecx, dword [esp + 0x70]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 1
ja 0x44375a
call fcn.004fe843
mov eax, dword [esp + 0x70]
add eax, 0x1c
call fcn.00442810
mov dword [esp + 0x3c], eax
mov byte [esp + 0xa08], 0x1f
lea edx, [esp + 0x64]
push edx
call fcn.00445ee0
mov byte [esp + 0xa08], 0x1d
lea ecx, [esp + 0x34]
call fcn.00402750
mov ecx, dword [esp + 0xc4]
mov esi, dword [esp + 0xc0]
mov edi, dword [esp + 0x5c]
add dword [esp + 0x60], 0x1c
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
mov dword [esp + 0x5c], edi
cmp edi, eax
jb 0x4434e6
mov esi, dword [esp + 0x3c]
cmp esi, 0xffffffff
je 0x4437da
call fcn.00457020
push eax
call fcn.004631f0
mov edi, dword [esp + 0x2c]
cmp edi, 0xffffffff
je 0x4437fc
mov esi, dword [esp + 0x18]
cmp esi, 0xffffffff
je 0x4437fc
call fcn.00457020
push esi
push edi
push 1
mov edi, eax
call fcn.00462d10
mov byte [esp + 0xa08], 0x1c
lea eax, [esp + 0xb4]
push eax
call fcn.00445ee0
mov byte [esp + 0xa08], 0x17
lea ecx, [esp + 0x4c]
call fcn.00402750
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x50]
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.Exclude_drive:
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x4438ef
sub eax, ecx
sar eax, 1
jne 0x4438ef
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.0040cbb0
mov byte [esp + 0xa08], 0x22
mov eax, dword [esp + 0x44]
cmp dword [eax - 0xc], 0
jge 0x44387e
or eax, 0xffffffff
jmp 0x44389b
push 0x632c38
push eax
call fcn.0050006e
add esp, 8
test eax, eax
jne 0x443895
or eax, 0xffffffff
jmp 0x44389b
sub eax, dword [esp + 0x44]
sar eax, 1
inc eax
lea ebx, [esp + 0x44]
call fcn.0042ada0
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
mov ecx, ebx
push ecx
push eax
call fcn.0040cbb0
mov byte [esp + 0xa0c], 0x23
mov byte [esp + 0xa0c], 0x22
call fcn.00425060
add esp, 4
mov esi, eax
call fcn.00457020
push esi
mov edi, eax
call fcn.00462e90
mov byte [esp + 0xa08], 0x17
mov ecx, ebx
call fcn.00402750
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.Unexclude_drive:
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x4439b4
sub eax, ecx
sar eax, 1
jne 0x4439b4
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.0040cbb0
mov byte [esp + 0xa08], 0x24
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], 0
jge 0x443943
or eax, 0xffffffff
jmp 0x443960
push 0x632c38
push eax
call fcn.0050006e
add esp, 8
test eax, eax
jne 0x44395a
or eax, 0xffffffff
jmp 0x443960
sub eax, dword [esp + 0x30]
sar eax, 1
inc eax
lea ebx, [esp + 0x30]
call fcn.0042ada0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov edx, ebx
push edx
push ecx
call fcn.0040cbb0
mov byte [esp + 0xa0c], 0x25
mov byte [esp + 0xa0c], 0x24
call fcn.00425060
add esp, 4
mov esi, eax
call fcn.00457020
push esi
mov edi, eax
call fcn.00462fd0
mov byte [esp + 0xa08], 0x17
mov ecx, ebx
call fcn.00402750
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.opt_prot
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x4439de
sub eax, ecx
sar eax, 1
je 0x443a7e
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.opt_scan
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x443a04
sub eax, ecx
sar eax, 1
je 0x443a7e
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.opt_update
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x443a2a
sub eax, ecx
sar eax, 1
je 0x443a7e
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.opt_sch
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x443a50
sub eax, ecx
sar eax, 1
je 0x443a7e
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.opt_other
push ecx
call fcn.0050006e
add esp, 8
test eax, eax
je 0x443d9c
mov ecx, dword [esp + 0x14]
sub eax, ecx
sar eax, 1
jne 0x443da0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040cbb0
mov byte [esp + 0xa08], 0x26
mov eax, dword [esp + 0x38]
cmp dword [eax - 0xc], 0
jge 0x443aa4
or eax, 0xffffffff
jmp 0x443ac1
push 0x632c38
push eax
call fcn.0050006e
add esp, 8
test eax, eax
jne 0x443abb
or eax, 0xffffffff
jmp 0x443ac1
sub eax, dword [esp + 0x38]
sar eax, 1
inc eax
lea ebx, [esp + 0x38]
call fcn.0042ada0
mov ecx, ebx
call fcn.004061b0
mov ecx, dword [0x66b0e4]
sub ecx, dword [0x66b0e0]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x443d74
mov ecx, dword [0x66b064]
add ecx, 0xc0
push ecx
call fcn.0046b6c0
call fcn.00402620
mov ecx, dword [0x66b0e4]
sub ecx, dword [0x66b0e0]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor ebp, ebp
add eax, edx
je 0x443d4d
xor edi, edi
mov dword [esp + 0x18], edi
cmp ebp, eax
jb 0x443b44
call fcn.004fe843
mov edx, dword [0x66b0e0]
mov eax, dword [edi + edx]
add edi, edx
test eax, eax
jne 0x443b6a
movzx edx, byte [edi + 0xc]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00402150
jmp 0x443d1a
cmp eax, 1
jne 0x443b85
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00401e90
jmp 0x443d1a
cmp eax, 2
jne 0x443bbc
push ecx
lea eax, [edi + 0x14]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.004011a0
mov byte [esp + 0xa0c], 0x27
mov eax, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push edi
mov byte [esp + 0xa14], 0x26
call fcn.00402380
jmp 0x443d1a
cmp eax, 3
jne 0x443d1a
mov eax, dword [edi + 4]
push str.Realtime
push eax
call fcn.004feef2
add esp, 8
test eax, eax
sete al
test al, al
je 0x443cba
lea esi, [edi + 8]
push esi
mov ecx, str.RealtimeNew
call fcn.00445ce0
add esp, 4
test al, al
je 0x443cba
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
call fcn.00401270
mov byte [esp + 0xa0c], 0x28
push ecx
mov dword [esp + 0x44], esp
mov ebx, esp
push 0xffffffffffffffff
push str.RealtimeNew
call fcn.00483890
add esp, 8
mov dword [ebx], eax
mov byte [esp + 0xa10], 0x29
push str.Realtime
lea ecx, [esp + 0x64]
mov bl, 0x26
push ecx
mov byte [esp + 0xa18], bl
call fcn.00401660
mov byte [esp + 0xa08], 0x2a
lea edx, [edi + 0x18]
push edx
lea ecx, [esp + 0x5c]
call fcn.004466f0
push ecx
lea eax, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.004012d0
mov byte [esp + 0xa0c], 0x2b
call fcn.0040cb30
push ecx
mov dword [esp + 0x44], esp
mov esi, esp
push 0xffffffffffffffff
push eax
call fcn.00483890
add esp, 8
mov dword [esi], eax
mov byte [esp + 0xa10], 0x2c
mov edi, dword [edi + 4]
push edi
mov byte [esp + 0xa14], 0x2a
call fcn.00401b80
mov byte [esp + 0xa08], bl
lea ecx, [esp + 0x58]
call fcn.00401340
jmp 0x443d1a
push ecx
lea edx, [edi + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.004012d0
mov byte [esp + 0xa0c], 0x2d
mov eax, dword [edi + 8]
lea esi, [edi + 8]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x443ceb
mov eax, dword [eax + 4]
push eax
push esi
call fcn.0040e950
mov esi, dword [esi]
push ecx
mov dword [esp + 0x44], esp
mov ebx, esp
push 0xffffffffffffffff
push esi
call fcn.00483890
add esp, 8
mov dword [ebx], eax
mov byte [esp + 0xa10], 0x2e
mov edi, dword [edi + 4]
push edi
mov byte [esp + 0xa14], 0x26
call fcn.00401b80
mov ecx, dword [0x66b0e4]
sub ecx, dword [0x66b0e0]
mov edi, dword [esp + 0x18]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebp
add edi, 0x1c
add eax, edx
mov dword [esp + 0x18], edi
cmp ebp, eax
jb 0x443b44
call fcn.00402620
mov ecx, dword [0x66b064]
add ecx, 0xc0
push ecx
call fcn.0046b6c0
call fcn.00457020
mov ecx, eax
call fcn.0045cc50
mov ebp, dword [esp + 0x50]
mov byte [esp + 0xa08], 0x17
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x443d9c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.Download_Updates
push ecx
call fcn.0050006e
mov ecx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x443dd8
sub eax, ecx
sar eax, 1
jne 0x443dd8
call fcn.00457020
push 0
mov edi, eax
call fcn.0045c240
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jl 0x443f2e
push str.Uninstall_Client
push ecx
call fcn.0050006e
add esp, 8
test eax, eax
je 0x443f2e
sub eax, dword [esp + 0x14]
sar eax, 1
jne 0x443f2e
cmp dword [0x66b0b8], 0
je 0x443f11
lea ecx, [esp + 0x48]
push ecx
call fcn.0040cb50
mov byte [esp + 0xa08], 0x30
mov edx, dword [0x66b0b8]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x200]
push ecx
push 0
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallSecuraShield_Ultimate_Internet_Security_is1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x443ea2
mov edx, dword [esp + 0x20]
shr edx, 1
mov word [esp + edx*2 + 0x1fc], ax
lea eax, [esp + 0x1fc]
lea edx, [eax + 2]
jmp 0x443e80
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x443e80
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x1fc]
mov ebx, eax
push ecx
lea eax, [esp + 0x4c]
call fcn.004028e0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [esp + 0x48]
cmp dword [edx - 0xc], 0
je 0x443efe
mov esi, dword [0x66b0b8]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str._VERYSILENT
call fcn.004026a0
mov byte [esp + 0xa0c], 0x31
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
lea edx, [esp + 0x50]
push edx
push ecx
call fcn.0040cbb0
mov byte [esp + 0xa10], 0x32
mov byte [esp + 0xa10], 0x30
mov ecx, esi
call fcn.00442620
add esp, 8
mov byte [esp + 0xa08], 0x17
lea ecx, [esp + 0x48]
call fcn.00402750
jmp 0x443f2e
cmp dword [0x65236c], 3
jl 0x443f2e
push str.User_token_is_not_available
push str.Reporter::SendReport
push 3
call fcn.004fa3c2
add esp, 0xc
mov byte [esp + 0xa08], 0x15
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443f56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x8c]
sub ecx, dword [esp + 0x88]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebp
add eax, edx
mov dword [esp + 0x50], ebp
cmp ebp, eax
jb 0x443178
mov byte [esp + 0xa08], 0xa
lea ecx, [esp + 0x7c]
push ecx
call fcn.00445ee0
mov byte [esp + 0xa08], 1
lea ecx, [esp + 0x28]
call fcn.00402750
mov edx, dword [esp + 0x54]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov byte [esp + 0xa08], 0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x443fda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xa08], 0xffffffff
mov eax, dword [esp + 0xa10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x444008
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xa00]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x9e8]
xor ecx, esp
call fcn.004fdb4a
add esp, 0x9f8
ret 8