Function at 0x530d5f
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], 0
push 8
call fcn.0057499e
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x6bb515
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 8
call fcn.0057499e
add esp, 4
mov dword [ebp - 0x18], eax
mov edi, eax
mov esi, 0x6bb515
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
push 8
call fcn.0057499e
add esp, 4
mov dword [ebp - 0x30], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0xe0002
push 0
push ebx
push 1
mov eax, 0xd
mov ebx, 0x63ba90
call fcn.00574998
add esp, 0x10
push 4
call fcn.0057499e
add esp, 4
mov dword [ebp - 0x34], eax
mov ebx, eax
mov dword [ebx], 0
push 0xe0001
push 0
push ebx
push 1
mov eax, 0xd
mov ebx, 0x639dc0
call fcn.00574998
add esp, 0x10
mov dword [ebp - 0x38], 0
mov ebx, dword [0xc384a4]
add ebx, 0x28
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x3c]
mov eax, dword [ebx]
test eax, eax
je 0x530e7d
push eax
mov ebx, eax
call fcn.0040103d
inc eax
push eax
call fcn.0057499e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x530e8e
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x6bb514
push dword [ebp - 4]
call fcn.0040110c
add esp, 8
cmp eax, 0
je 0x530fa1
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x95f29b
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x530ed0
mov eax, 0x6bb514
push eax
push 3
mov ebx, 0x5760a0
call fcn.005749a4
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 8]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x530f08
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x530f04
imul eax, dword [ebx]
jmp 0x530ef9
mov ecx, eax
test ecx, ecx
je 0x530f27
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x530f20
push ebx
push eax
call fcn.00574992
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x530f0e
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
call fcn.00401004
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jne 0x530fa1
mov ebx, dword [ebp - 8]
call fcn.0040101d
mov eax, 1
cmp eax, ecx
jl 0x530f66
push 1
call fcn.005749b6
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x3c]
mov eax, dword [ebx]
test eax, eax
je 0x530f8c
push eax
mov ebx, eax
call fcn.0040103d
inc eax
push eax
call fcn.0057499e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x530f9d
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push 0x9556f1
push dword [ebp - 0xc]
call fcn.0040110c
add esp, 8
cmp eax, 0
je 0x530fd7
push 0x6bb514
push dword [ebp - 0xc]
call fcn.0040110c
add esp, 8
cmp eax, 0
je 0x530fd7
xor eax, eax
jmp 0x530fdc
mov eax, 1
test eax, eax
je 0x53145b
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_FoldersCookies
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x577eb0
call fcn.005749a4
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x53102b
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x53104b
push eax
mov ebx, eax
call fcn.0040103d
inc eax
push eax
call fcn.0057499e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x53105c
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov dword [ebp - 0x44], 0
push 0
lea eax, [ebp - 0x44]
push eax
push 1
push 0
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
mov eax, str.bjyljq
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.005317aa
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x5310bf
push ebx
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x18]
call fcn.00401004
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x531133
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov dword [ebp - 0x44], 0
push 0
lea eax, [ebp - 0x44]
push eax
push 1
push 0
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
mov eax, str.zgfc
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.005317aa
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x531133
push ebx
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x18]
call fcn.00401004
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x53145b
mov ebx, dword [ebp - 0x18]
call fcn.00401004
xor ecx, ecx
push eax
lea eax, [ebp - 0x1c]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x531458
mov ebx, dword [ebp - 0x18]
call fcn.0040101d
push ebx
push ecx
mov eax, dword [ebp - 0x1c]
dec eax
jns 0x531184
push 4
call fcn.005749b6
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x531197
push 1
call fcn.005749b6
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x3c], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 0x3c]
mov eax, dword [ebx]
test eax, eax
jne 0x5311b4
mov eax, 0x6bb514
push eax
push 1
mov ebx, 0x577200
call fcn.005749a4
add esp, 0x10
mov dword [ebp - 0x40], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x5311dd
mov eax, 0x6bb515
push eax
push 1
mov ebx, 0x5765e0
call fcn.005749a4
add esp, 0x10
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x531203
push ebx
call fcn.00574992
add esp, 4
mov eax, dword [ebp - 0x44]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x531217
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
mov eax, str.IntroduceName
push eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x531231
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 0x24], eax
push reloc.WS2_32.dll_bind
push 0
push 1
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x53125a
mov eax, 0x6bb514
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x53126e
mov eax, 0x6bb514
push eax
push 4
mov ebx, 0x5756d0
call fcn.005749a4
add esp, 0x34
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jle 0x531450
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x5312a1
mov eax, 0x6bb514
push eax
push 1
mov ebx, 0x574e80
call fcn.005749a4
add esp, 0x10
mov dword [ebp - 0x3c], eax
fild dword [ebp - 0x28]
fstp qword [ebp - 0x44]
fld qword [ebp - 0x44]
fild dword [ebp - 0x3c]
fstp qword [ebp - 0x4c]
fadd qword [ebp - 0x4c]
fstp qword [ebp - 0x54]
fld qword [ebp - 0x54]
call fcn.004022e4
push 0
push 0
push 0
push 0x80000301
push 0
push eax
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x531301
mov eax, 0x6bb514
push eax
push 4
mov ebx, 0x575e00
call fcn.005749a4
add esp, 0x34
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x53132b
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
push 0x80000101
push 0
push 0xa
push 1
mov ebx, 0x5754d0
call fcn.005749a4
add esp, 0x10
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x531364
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 0x24], eax
push reloc.WS2_32.dll_bind
push 0
push 1
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x53138d
mov eax, 0x6bb514
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x5313a1
mov eax, 0x6bb514
push eax
push 4
mov ebx, 0x5756d0
call fcn.005749a4
add esp, 0x34
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fsub qword [0x6bb645]
fstp qword [ebp - 0x48]
fld qword [ebp - 0x48]
call fcn.004022e4
push 0x80000301
push 0
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x5313ec
mov eax, 0x6bb514
push eax
push 2
mov ebx, 0x5753e0
call fcn.005749a4
add esp, 0x1c
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x531416
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x531436
push eax
mov ebx, eax
call fcn.0040103d
inc eax
push eax
call fcn.0057499e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x531447
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
jmp 0x531458
pop eax
pop ebx
pop ecx
jmp 0x531159
add esp, 0xc
push 0x6bb514
push dword [ebp - 0xc]
call fcn.0040110c
add esp, 8
cmp eax, 0
je 0x531494
push 0x9556f1
push dword [ebp - 0xc]
call fcn.0040110c
add esp, 8
cmp eax, 0
je 0x531494
mov eax, 1
jmp 0x531496
xor eax, eax
test eax, eax
je 0x531640
push 0x888f73
push dword [ebp - 0xc]
push str.SELECT_COUNT___AS_recs_FROM_au_employee_where_uid
mov ecx, 3
call fcn.004010a8
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x5314cf
push ebx
call fcn.00574992
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0x6bb752
mov ecx, 2
call fcn.004010a8
add esp, 8
mov dword [ebp - 0x3c], eax
push 1
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
push 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040406f
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x53151c
push ebx
call fcn.00574992
add esp, 4
push 0xe0002
push 0
push dword [ebp - 0x30]
push 1
mov eax, 0xd
mov ebx, 0x63a870
call fcn.00574998
add esp, 0x10
and eax, 1
xor eax, 1
test eax, eax
je 0x5315d0
push 0xe0002
push 0
push dword [ebp - 0x30]
push 1
mov eax, 0xd
mov ebx, 0x63acb0
call fcn.00574998
add esp, 0x10
push 0xe0001
push 0
lea eax, [ebp - 0x34]
push eax
push 0xe0002
push 0
push dword [ebp - 0x30]
push 2
mov eax, 0xd
mov ebx, 0x63add0
call fcn.00574998
add esp, 0x1c
push reloc.WS2_32.dll_connect
push 0
lea eax, [ebp - 0x38]
push eax
push reloc.WS2_32.dll_connect
push 0
push str.recs
push 0xe0001
push 0
push dword [ebp - 0x34]
push 3
mov eax, 0xd
mov ebx, 0x63a690
call fcn.00574998
add esp, 0x28
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x5315e3
mov eax, 0x6bb514
push eax
push 1
mov ebx, 0x575960
call fcn.005749a4
add esp, 0x10
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
fld qword [ebp - 0x48]
fcomp qword [0x6bb63d]
fnstsw ax
test ah, 0x41
jne 0x531636
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x53162c
push eax
mov ebx, eax
call fcn.0040103d
inc eax
push eax
call fcn.0057499e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x53164a
mov eax, 0x6bb514
jmp 0x53164a
mov eax, 0x6bb514
jmp 0x53164a
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x53165b
push ebx
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x531679
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x531675
imul eax, dword [ebx]
jmp 0x53166a
mov ecx, eax
test ecx, ecx
je 0x531698
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x531691
push ebx
push eax
call fcn.00574992
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x53167f
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x5316b0
push ebx
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x5316c0
push ebx
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x5316d0
push ebx
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x5316ee
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x5316ea
imul eax, dword [ebx]
jmp 0x5316df
mov ecx, eax
test ecx, ecx
je 0x53170d
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x531706
push ebx
push eax
call fcn.00574992
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x5316f4
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x531725
push ebx
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x531735
push ebx
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x531745
push ebx
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x30]
push ebx
push 0xe0002
push 0
push ebx
push 1
mov eax, 0xd
mov ebx, 0x63a810
call fcn.00574998
add esp, 0x10
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x34]
push ebx
push 0xe0001
push 0
push ebx
push 1
mov eax, 0xd
mov ebx, 0x639df0
call fcn.00574998
add esp, 0x10
call fcn.00574992
add esp, 4
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x5317a5
push ebx
call fcn.00574992
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret