Function at 0x490100
Capabilities:
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb966
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x4a98
call fcn.004f2630
push ebx
push esi
push edi
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x98]
push ecx
call fcn.00401350
add esp, 4
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x18], ebx
push 1
call fcn.004f0653
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0xe0]
push edx
push 1
push str.c:endpcacheuser_id.txt
mov byte [ebp - 4], 1
call fcn.004f0727
mov edi, dword [ebp - 0xdc]
push 0xa
lea eax, [ebp - 0x6a8]
inc edi
push 0x100
push eax
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xdc], edi
call fcn.004f0ae9
lea edi, [ebp - 0x6a8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jle 0x49024d
lea ecx, [ebp - 0x6a8]
push 0x51ed80
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x490218
lea edx, [ebp - 0x6a8]
push 0x51ed84
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x490218
lea eax, [ebp - 0x6a8]
push 0x52609c
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x490218
lea ecx, [ebp - 0x6a8]
push 0x526098
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49024d
mov edx, ebx
lea edi, [ebp - 0x6a8]
or ecx, 0xffffffff
xor eax, eax
shl edx, 7
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp + edx - 0x4aa8]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp ebx, 0x40
rep movsb byte es:[edi], byte [esi]
je 0x490270
mov eax, dword [ebp - 0x18]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x18], eax
jg 0x490270
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ecx + 4]
test byte [ebp + edx - 0xd8], 1
je 0x490179
lea ecx, [ebp - 0xe0]
call fcn.004f076e
mov dword [ebp - 0x24], 0
call fcn.004b1530
call fcn.004ac240
call fcn.004ac4a0
call fcn.004ac6c0
call fcn.004ac8e0
call fcn.004acb00
call fcn.004acd20
call fcn.004acf40
call fcn.004ad160
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x2aa8]
push eax
push ecx
call fcn.004c6c30
mov eax, dword [ebp - 0x24]
add esp, 8
xor edi, edi
cmp ebx, eax
jle 0x4902d3
mov dword [ebp - 0x24], ebx
mov edi, 1
xor ebx, ebx
cmp ebx, dword [ebp - 0x24]
jge 0x490474
test edi, edi
jne 0x4903ad
mov edx, ebx
shl edx, 7
lea esi, [ebp + edx - 0x2aa8]
push esi
call fcn.004ad380
add esp, 4
push esi
call fcn.004ad610
add esp, 4
push esi
call fcn.004ad890
add esp, 4
push esi
call fcn.004adb10
add esp, 4
push esi
call fcn.004add90
add esp, 4
push esi
call fcn.004ae020
add esp, 4
push esi
call fcn.004ae2a0
add esp, 4
push esi
call fcn.004ae520
add esp, 4
push esi
call fcn.004ad380
add esp, 4
lea eax, [ebp - 0x528]
mov byte [ebp - 0x528], 0
push esi
push str._sSoftwareMicrosoftWindows_NTCurrentVersionWindows
push eax
call fcn.004f175f
lea ecx, [ebp - 0x528]
push str.load
push ecx
push str.HKCU
call fcn.004bf570
add esp, 0x18
lea edx, [ebp - 0x528]
mov byte [ebp - 0x528], 0
push esi
push str._sSoftwareMicrosoftWindows_NTCurrentVersionWindows
push edx
call fcn.004f175f
lea eax, [ebp - 0x528]
push 0x5142f8
push eax
push str.HKCU
call fcn.004bf570
add esp, 0x18
inc ebx
jmp 0x4902d5
mov ecx, ebx
shl ecx, 7
lea esi, [ebp + ecx - 0x4aa8]
push esi
call fcn.004ad380
add esp, 4
push esi
call fcn.004ad610
add esp, 4
push esi
call fcn.004ad890
add esp, 4
push esi
call fcn.004adb10
add esp, 4
push esi
call fcn.004add90
add esp, 4
push esi
call fcn.004ae020
add esp, 4
push esi
call fcn.004ae2a0
add esp, 4
push esi
call fcn.004ae520
add esp, 4
push esi
call fcn.004ad380
add esp, 4
lea edx, [ebp - 0x528]
mov byte [ebp - 0x528], 0
push esi
push str._sSoftwareMicrosoftWindows_NTCurrentVersionWindows
push edx
call fcn.004f175f
lea eax, [ebp - 0x528]
push str.load
push eax
push str.HKCU
call fcn.004bf570
add esp, 0x18
lea ecx, [ebp - 0x528]
mov byte [ebp - 0x528], 0
push esi
push str._sSoftwareMicrosoftWindows_NTCurrentVersionWindows
push ecx
call fcn.004f175f
lea edx, [ebp - 0x528]
push 0x5142f8
push edx
push str.HKCU
call fcn.004bf570
add esp, 0x18
inc ebx
jmp 0x4902d5
call fcn.004af8c0
call fcn.004afb80
call fcn.004afe00
call fcn.004b0080
call fcn.004b0320
call fcn.004b05b0
call fcn.004b0830
call fcn.004b0ab0
call fcn.004b0d30
call fcn.004b0f70
call fcn.004b1190
call fcn.004af1e0
call fcn.004af480
call fcn.004af6c0
call fcn.004b1500
mov esi, eax
push 1
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x5c], esi
call fcn.004f0653
push 0x2c0
mov byte [ebp - 4], 2
call fcn.004f266a
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add esp, 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x728]
push 0x80
push eax
call edi
lea ecx, [ebp - 0x8a8]
push 0x80
push ecx
call edi
mov edx, dword [0x4fe4e8]
mov ebx, 1
push edx
push ebx
push str.c:endpcache_auto_repair.txt
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x3c], 0
call fcn.004f0727
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0xdc]
cmp dword [eax + 0x30], 0xffffffff
je 0x4905af
mov edi, dword [ebp - 0xdc]
push 0xa
lea edx, [ebp - 0x5a8]
inc edi
push 0x40
push edx
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xdc], edi
call fcn.004f0ae9
lea edi, [ebp - 0x5a8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jle 0x4905af
lea eax, [ebp - 0x5a8]
push str.close
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x490594
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x5a8]
push str.startup
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4905af
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0xe0]
call fcn.004f076e
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x128]
push edx
push 8
push str.c:endpcacheprocess_log_HKLM.txt
call fcn.004f0727
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], ebx
cmp ebx, esi
jge 0x491474
push ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x1c], eax
call fcn.004b1510
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
jge 0x490741
test ecx, ecx
jle 0x490741
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.004b1440
mov ecx, dword [ebp - 0x14]
add esp, 8
add ecx, 0x40
push ecx
call fcn.004fa6c0
mov edx, dword [ebp - 0x14]
mov esi, eax
push edx
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x490666
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x40]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
push 0
push esi
push closesocket
jmp 0x490681
lea edx, [ebp - 0x6c]
lea eax, [ebp - 0x40]
push edx
push eax
push 0
push 2
push 0
push 0xc30c0c
push 0
push esi
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x490738
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x40]
add ecx, 0x140
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4906b1
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
push str.load
add ecx, 0x140
mov byte [ebp - 0x428], 0
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x490738
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x98]
add edx, 0x140
push edx
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1a8]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x428]
push eax
push 0x51719c
push edx
call fcn.004f175f
add esp, 0x14
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x11c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x40]
push ecx
jmp 0x49145d
push str.c:endpcachedownAutohc.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x491463
push str._ProgramFiles_Windows_SidebarSidebar.exe__autoRun
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x491463
push str._ProgramFiles_Windows_SidebarSidebar.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
push str.c:endpcache
push esi
call fcn.004f2d80
push str.soundman.exe
push esi
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x4907ad
cmp dword [0xe56bd8], 1
je 0x491463
lea edx, [ebp - 0x728]
lea eax, [ebp - 0x428]
push edx
push str._sctfmon.exe
push eax
mov byte [ebp - 0x428], 0
call fcn.004f175f
lea ecx, [ebp - 0x428]
push ecx
push esi
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x491463
lea edx, [ebp - 0x728]
lea eax, [ebp - 0x428]
push edx
push str._sinternat.exe
push eax
mov byte [ebp - 0x428], 0
call fcn.004f175f
lea ecx, [ebp - 0x428]
push ecx
push esi
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x491463
push str.ctfmon.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x491463
push str.internat.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x491463
push str._system32ctfmon.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
push str._system32internat.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
push str.System32ctfmon.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
push str.System32internat.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
push str.stem32dumprep
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
push str.IMETINTLGNTTINTSETP.EXE
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
push str.IMEimjp8_1IMJPMIG.EXE
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
push str.IgAgent.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x491463
push str.NvCpl.dll_NvStartup
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
mov eax, dword [0xe56da0]
mov ebx, 1
cmp eax, ebx
jne 0x49094f
push str.ShowWelcomeCenter
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
cmp dword [0xe56da0], ebx
jne 0x49094f
push str.Core_StaticCLIStart.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x491463
push str..bat
push esi
call fcn.004f2d80
push str..reg
push esi
call fcn.004f2d80
push str..com
push esi
call fcn.004f2d80
add esp, 0x18
test eax, eax
je 0x490985
push str..com_
push esi
call fcn.004f2d80
add esp, 8
push str..pif
push esi
call fcn.004f2d80
push str..scr
push esi
call fcn.004f2d80
push str..hta
push esi
call fcn.004f2d80
push str..vbs
push esi
call fcn.004f2d80
add esp, 0x20
test eax, eax
je 0x4909c3
cmp dword [0xe56bec], ebx
jne 0x4909c3
mov dword [ebp - 0x1c], ebx
push str..VBS
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4909e0
cmp dword [0xe56bec], ebx
jne 0x4909e0
mov dword [ebp - 0x1c], ebx
push str..Vbs
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4909fd
cmp dword [0xe56bec], ebx
jne 0x4909fd
mov dword [ebp - 0x1c], ebx
push str..vba
push esi
call fcn.004f2d80
push 0x516fc8
push esi
call fcn.004f2d80
push str..bmp
push esi
call fcn.004f2d80
push str..BMP
push esi
call fcn.004f2d80
push 0x516860
push esi
call fcn.004f2d80
push str..jse
push esi
call fcn.004f2d80
push str..wsf
push esi
call fcn.004f2d80
push str..wsh
push esi
call fcn.004f2d80
add esp, 0x40
push str.regedit
push esi
call fcn.004f2d80
push str.http
push esi
call fcn.004f2d80
push str.Http
push esi
call fcn.004f2d80
push 0x51688c
push esi
call fcn.004f2d80
push str.Rundll32
push esi
call fcn.004f2d80
push 0x5222fc
push esi
call fcn.004f2d80
push str.IEXPLORE
push esi
call fcn.004f2d80
push str.Temp
push esi
call fcn.004f2d80
add esp, 0x40
push str.Application_Data
push esi
call fcn.004f2d80
push str.windows_
push esi
call fcn.004f2d80
push str.WINDOWS_
push esi
call fcn.004f2d80
push str.WINNT_
push esi
call fcn.004f2d80
push str.winnt_
push esi
call fcn.004f2d80
push str._system
push esi
call fcn.004f2d80
push str.System
push esi
call fcn.004f2d80
push str.regsvr32
push esi
call fcn.004f2d80
add esp, 0x40
push 0x5147e0
push esi
call fcn.004f2d80
push 0x516f24
push esi
call fcn.004f2d80
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
cmp eax, ecx
jge 0x490b43
cmp byte [eax + esi], 0x5c
jne 0x490b40
inc edx
inc eax
jmp 0x490b35
push 0x515e8c
push esi
call fcn.004f2d80
push 0x515e88
push esi
call fcn.004f2d80
push str..pif
push esi
call fcn.004f2d80
push str..Pif
push esi
call fcn.004f2d80
push str..kxp
push esi
call fcn.004f2d80
mov eax, dword [0xe56be4]
add esp, 0x28
xor edi, edi
cmp eax, ebx
mov byte [ebp - 0x428], 0
jne 0x490bcf
xor ebx, ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 2
jge 0x490bc9
shl ebx, 8
push esi
lea edx, [ebx + 0xc5159c]
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x490bbe
lea eax, [ebx + 0x510324]
push eax
call fcn.004fa6c0
jmp 0x490bd5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov ebx, eax
jmp 0x490b94
xor eax, eax
test eax, eax
jne 0x490bda
push esi
call fcn.00410fd0
add esp, 4
mov edi, eax
push str.load
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push str.HKCU
call fcn.004bf570
add esp, 0xc
push 0x5147b4
push edi
call fcn.004f2d80
push 0x5144fc
push edi
mov ebx, eax
call fcn.004f2d80
push 0x516f10
push edi
mov dword [ebp - 0x18], eax
call fcn.004f2d80
push 0x5222e0
push edi
mov dword [ebp - 0x48], eax
call fcn.004f2d80
push 0x5222d4
push edi
call fcn.004f2d80
push 0x516efc
push edi
mov dword [ebp - 0x58], eax
call fcn.004f2d80
push 0x5222c8
push edi
mov dword [ebp - 0x50], eax
call fcn.004f2d80
push str..NET
push edi
mov dword [ebp - 0x60], eax
call fcn.004f2d80
add esp, 0x40
mov dword [ebp - 0x4c], eax
test ebx, ebx
jne 0x490d37
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x490d37
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x490d37
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x490d37
mov eax, dword [ebp - 0x60]
test eax, eax
jne 0x490d37
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x490d37
mov eax, dword [ebp - 0x58]
test eax, eax
jne 0x490d37
push edi
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x98]
push eax
push esi
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x1a8]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x428]
push 0x516eb4
push eax
call fcn.004f175f
mov edx, dword [0xe56d24]
mov ecx, dword [0xe56d68]
add esp, 0x18
inc edx
inc ecx
mov dword [0xe56d24], edx
mov dword [0xe56d68], ecx
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x11c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ebx, 1
mov dword [ebp - 0x34], ebx
jmp 0x490de0
push edi
lea edx, [ebp - 0x98]
push esi
push edx
mov byte [ebp - 0x428], 0
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x428]
push eax
push 0x516e8c
push ecx
call fcn.004f175f
add esp, 0x18
lea edx, [ebp - 0x428]
lea ecx, [ebp - 0x11c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x490dbe
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x490dbe
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x490dbe
mov eax, dword [ebp - 0x58]
test eax, eax
jne 0x490dbe
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x490dc5
mov dword [ebp - 0x1c], 1
push str.StarSoftComm
push edi
xor ebx, ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x490de0
mov dword [ebp - 0x54], 1
push str.StartPowerManager
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x490e2c
push str.StartBattLog
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x490e2c
push str.PwrMgrBkGndMonitor
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x490e2c
push str.Bluetooth
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x490f33
mov dword [ebp - 0x1c], 1
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x3c], 1
jne 0x4911cc
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4911cc
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x98]
add edx, 0x140
mov byte [ebp - 0x428], 0
push edx
push esi
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1a8]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x428]
push eax
push 0x516dac
push edx
call fcn.004f175f
add esp, 0x18
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x11c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x14]
push ecx
push edx
call fcn.004b1440
mov eax, dword [ebp - 0x14]
add esp, 8
add eax, 0x40
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0x14]
mov ebx, eax
add ecx, 0x40
push ecx
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x9a8]
push 0x50d39c
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x14]
push eax
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x49117a
lea ecx, [ebp - 0x68]
lea edx, [ebp - 0x44]
push ecx
push edx
push eax
push 2
push eax
push 0xc30c0c
push eax
push ebx
push closesocket
jmp 0x49119b
mov edi, 1
cmp ebx, edi
jne 0x491053
lea eax, [ebp - 0x98]
push esi
push eax
mov byte [ebp - 0x428], 0
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1a8]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x428]
push eax
push 0x516de0
push edx
call fcn.004f175f
add esp, 0x14
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x11c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x14]
push ecx
push edx
mov dword [ebp - 0x34], edi
call fcn.004b1440
mov eax, dword [ebp - 0x14]
add esp, 8
add eax, 0x40
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0x14]
mov edi, eax
push ecx
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x490ffc
lea edx, [ebp - 0x78]
lea eax, [ebp - 0x2c]
push edx
push eax
push 0
push 2
push 0
push 0xc30c0c
push 0
push edi
push closesocket
jmp 0x491017
lea ecx, [ebp - 0x78]
lea edx, [ebp - 0x2c]
push ecx
push edx
push 0
push 2
push 0
push 0xc30c0c
push 0
push edi
push reloc.WS2_32.dll_closesocket
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call edi
test eax, eax
jne 0x491044
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
add eax, 0x140
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x491044
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x490e39
cmp ebx, 2
jne 0x490e33
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x490e33
lea ecx, [ebp - 0x98]
push esi
push ecx
mov byte [ebp - 0x428], 0
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x1a8]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x428]
push 0x522264
push eax
call fcn.004f175f
add esp, 0x14
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x11c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push edx
push eax
mov dword [ebp - 0x34], edi
call fcn.004b1440
mov ecx, dword [ebp - 0x14]
add esp, 8
add ecx, 0x40
push ecx
call fcn.004fa6c0
mov edx, dword [ebp - 0x14]
mov edi, eax
push edx
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x491122
lea eax, [ebp - 0x74]
lea ecx, [ebp - 0x30]
push eax
push ecx
push 0
push ebx
push 0
push 0xc30c0c
push 0
push edi
push closesocket
jmp 0x49113d
lea edx, [ebp - 0x74]
lea eax, [ebp - 0x30]
push edx
push eax
push 0
push 2
push 0
push 0xc30c0c
push 0
push edi
push reloc.WS2_32.dll_closesocket
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call edi
test eax, eax
jne 0x49116b
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
add ecx, 0x140
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x49116b
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x490e39
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x44]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
lea edx, [ebp - 0x9a8]
push 0
push edx
push reloc.WS2_32.dll_closesocket
call edi
test eax, eax
jne 0x4911c2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x44]
add eax, 0x140
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4911c2
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x54], 1
jne 0x49130a
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x98]
add ecx, 0x140
mov byte [ebp - 0x428], 0
push ecx
push esi
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x428]
push eax
push 0x516dac
push ecx
call fcn.004f175f
add esp, 0x18
lea edx, [ebp - 0x428]
lea ecx, [ebp - 0x11c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
push eax
push ecx
call fcn.004b1440
mov edx, dword [ebp - 0x14]
add esp, 8
add edx, 0x40
push edx
call fcn.004fa6c0
mov ebx, eax
mov eax, dword [ebp - 0x14]
add eax, 0x40
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x828]
push 0x50d39c
push ecx
call fcn.004f175f
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x4912b7
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x38]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
push 0
push ebx
push closesocket
jmp 0x4912d8
lea edx, [ebp - 0x70]
lea eax, [ebp - 0x38]
push edx
push eax
push 0
push 2
push 0
push 0xc30c0c
lea ecx, [ebp - 0x828]
push 0
push ecx
push reloc.WS2_32.dll_closesocket
call edi
test eax, eax
jne 0x491300
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
add edx, 0x140
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x491300
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x24]
sub eax, edi
sub eax, 5
cmp eax, 0xdc
jle 0x491463
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x491463
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x98]
add ecx, 0x140
mov byte [ebp - 0x428], 0
push ecx
push esi
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x428]
push eax
push 0x516dac
push ecx
call fcn.004f175f
add esp, 0x18
lea edx, [ebp - 0x428]
lea ecx, [ebp - 0x11c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
push eax
push ecx
call fcn.004b1440
mov edx, dword [ebp - 0x14]
add esp, 8
add edx, 0x40
push edx
call fcn.004fa6c0
mov esi, eax
mov eax, dword [ebp - 0x14]
add eax, 0x40
push eax
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0xaa8]
push 0x50d39c
push ecx
call fcn.004f175f
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x49140c
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x28]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
push 0
push esi
push closesocket
jmp 0x49142d
lea edx, [ebp - 0x64]
lea eax, [ebp - 0x28]
push edx
push eax
push 0
push 2
push 0
push 0xc30c0c
lea ecx, [ebp - 0xaa8]
push 0
push ecx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x491459
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
add edx, 0x140
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x491459
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x5c]
inc ebx
xor eax, eax
mov dword [ebp - 0x20], ebx
jmp 0x4905dd
cmp dword [ebp - 0x34], eax
jne 0x491527
lea eax, [ebp - 0x98]
push esi
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1a8]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x428]
push eax
push 0x522230
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x3c]
add esp, 0x14
cmp eax, 1
jne 0x4914ea
mov edi, 0x516d9c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x124]
cmp dword [eax + 0x30], 0xffffffff
je 0x491527
lea edx, [ebp - 0x428]
lea ecx, [ebp - 0x11c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x128]
call fcn.004f076e
mov eax, dword [ebp - 0x14]
push eax
call fcn.004f265f
add esp, 4
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 1
call fcn.004f0714
lea ecx, [ebp - 0x114]
call fcn.004f05fb
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0xcc]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret