Function at 0x437190
Capabilities:
Access peb ldr_data
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x619cb7
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x69cffc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
call fcn.0044a657
mov ecx, eax
test ecx, ecx
je 0x437632
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, str.SoftwareRegInfo
mov byte [ebp - 4], 1
shr eax, 0x10
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x43720c
mov ebx, str.SoftwareRegInfo
movzx eax, bx
push eax
call fcn.00402c80
jmp 0x437218
push 0x10
push str.SoftwareRegInfo
call fcn.00402df0
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi - 0x10]
lea eax, [esi - 0x10]
mov dword [ebp - 0x28], eax
test ecx, ecx
je 0x437237
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x43724d
call fcn.0044a657
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x43763c
mov eax, dword [ecx]
call dword [eax + 0xc]
push 7
push str.Client
push dword [esi - 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.00404650
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x24]
add esp, 0x14
mov dword [ebp - 0x24], 0
push eax
push 0x2001f
push 0
push esi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x24]
or ebx, 0xffffffff
mov dword [ebp - 0x1c], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 2
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4372bf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x28]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4372da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x4373ec
call fcn.0044a657
mov ecx, eax
test ecx, ecx
je 0x437646
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18]
cmp dword [ebp - 0x2c], edi
jne 0x437318
mov eax, str.SoftwareRegInfo
movzx eax, ax
push eax
call fcn.00402c80
jmp 0x437324
push 0x10
push str.SoftwareRegInfo
call fcn.00402df0
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi - 0x10]
lea eax, [esi - 0x10]
mov dword [ebp - 0x2c], eax
test ecx, ecx
je 0x437343
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x437359
call fcn.0044a657
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x437650
mov eax, dword [ecx]
call dword [eax + 0xc]
push 7
push str.Client
push dword [esi - 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.00404650
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x30]
add esp, 0x14
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push esi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [ebp - 0x1c]
add esi, 0xfffffff0
mov byte [ebp - 4], 5
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4373cb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4373e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x43761e
mov esi, dword [ebp - 0x14]
push ecx
mov ebx, esp
mov dword [ebp - 0x2c], ebx
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.004027b0
add esp, 4
add eax, 0x10
mov edx, str.ServerIP
mov dword [ebx], eax
mov ecx, edi
call fcn.00438dd0
add esp, 4
mov bh, al
and bh, 1
push ecx
mov dword [ebp - 0x2c], esp
mov eax, dword [esi + 4]
sub eax, 0x10
push eax
call fcn.004027b0
mov ecx, dword [ebp - 0x2c]
add eax, 0x10
add esp, 4
mov edx, str.BaseDirectory
mov dword [ecx], eax
mov ecx, edi
call fcn.00438dd0
add esp, 4
and bh, al
push ecx
mov dword [ebp - 0x2c], esp
mov eax, dword [esi + 8]
sub eax, 0x10
push eax
call fcn.004027b0
mov ecx, dword [ebp - 0x2c]
add eax, 0x10
add esp, 4
mov edx, str.UserName
mov dword [ecx], eax
mov ecx, edi
call fcn.00438dd0
add esp, 4
and bh, al
push ecx
mov dword [ebp - 0x2c], esp
mov eax, dword [esi + 0xc]
sub eax, 0x10
push eax
call fcn.004027b0
mov ecx, dword [ebp - 0x2c]
add eax, 0x10
add esp, 4
mov edx, 0x6727e4
mov dword [ecx], eax
mov ecx, edi
call fcn.00438dd0
add esp, 4
and bh, al
push ecx
mov dword [ebp - 0x2c], esp
mov eax, dword [esi + 0x10]
sub eax, 0x10
push eax
call fcn.004027b0
mov ecx, dword [ebp - 0x2c]
add eax, 0x10
add esp, 4
mov edx, 0x6727f8
mov dword [ecx], eax
mov ecx, edi
call fcn.00438dd0
add esp, 4
and bh, al
push ecx
mov dword [ebp - 0x2c], esp
mov eax, dword [esi + 0x1c]
sub eax, 0x10
push eax
call fcn.004027b0
mov ecx, dword [ebp - 0x2c]
add eax, 0x10
add esp, 4
mov edx, 0x670da0
mov dword [ecx], eax
mov ecx, edi
call fcn.00438dd0
add esp, 4
and bh, al
push ecx
mov dword [ebp - 0x2c], esp
mov eax, dword [esi + 0x20]
sub eax, 0x10
push eax
call fcn.004027b0
mov ecx, dword [ebp - 0x2c]
add eax, 0x10
add esp, 4
mov edx, str.OldVersion
mov dword [ecx], eax
mov ecx, edi
call fcn.00438dd0
add esp, 4
and bh, al
push ecx
mov dword [ebp - 0x2c], esp
mov eax, dword [esi + 0x24]
sub eax, 0x10
push eax
call fcn.004027b0
mov ecx, dword [ebp - 0x2c]
add eax, 0x10
add esp, 4
mov edx, 0x672824
mov dword [ecx], eax
mov ecx, edi
call fcn.00438dd0
add esp, 4
and bh, al
mov eax, dword [esi + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push 4
push eax
push 4
push 0
push str.SessionTime
push edi
call esi
test eax, eax
push 4
sete al
and bh, al
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 4
push 0
push str.ActiveDuration
push edi
call esi
test eax, eax
push 4
sete al
and bh, al
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 4
push 0
push str.CaptureTime
push edi
call esi
test eax, eax
sete al
and bh, al
mov eax, dword [ebp - 0x14]
push 4
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 4
push 0
push str.EnableRemote
push edi
call esi
test eax, eax
push 4
sete al
and bh, al
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 4
push 0
push str.EnableDataSend
push edi
call esi
test eax, eax
push edi
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and bl, bh
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403270
push 0x80004005
call fcn.00403270
push 0x80004005
call fcn.00403270
push 0x80004005
call fcn.00403270
int3