Function at 0x4389c2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get installed programs
Query or enumerate registry value
Resolve dns
Send data
Send data on socket
Set registry value

Disassembly:
push 0xa84
mov eax, 0x5bf23c
call fcn.00580bb4
mov esi, ecx
and dword [ebp - 4], 0
lea eax, [ebp - 0x920]
push eax
mov byte [ebp - 0x8f5], 0
call fcn.004084d7
mov byte [ebp - 4], 1
lea ebx, [esi + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x24]
lea edi, [ebp - 0x920]
call fcn.00408591
mov esi, dword [esi + 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
or ebx, 0xffffffff
mov dword [ebp - 0x94c], edi
cmp edi, ebx
jne 0x438a73
cmp dword [0x6bc38c], 3
jl 0x438a4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.socket_error____i
push 0x67d448
push 3
call fcn.00532652
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x920]
call fcn.0040856e
mov dword [ebp - 4], ebx
lea ecx, [ebp + 8]
call fcn.0040856e
xor al, al
call fcn.00580c37
ret 8
push 2
pop eax
push esi
mov word [ebp - 0x8cc], ax
call dword [sym.imp.WS2_32.dll_htons]
push ecx
mov word [ebp - 0x8ca], ax
mov eax, esp
mov dword [ebp - 0x8fc], esp
lea ecx, [ebp - 0x920]
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 2
lea eax, [ebp - 0x90c]
push eax
mov byte [ebp - 4], 1
call fcn.004040c2
pop ecx
pop ecx
mov byte [ebp - 4], 3
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x8c8], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90c]
call fcn.0040842d
cmp dword [ebp - 0x8c8], ebx
jne 0x438b74
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
lea ecx, [ebp - 0x920]
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 4
lea eax, [ebp - 0x90c]
push eax
mov byte [ebp - 4], 1
call fcn.004040c2
pop ecx
pop ecx
mov byte [ebp - 4], 5
push dword [eax]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90c]
call fcn.0040842d
test esi, esi
jne 0x438b5b
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [0x6bc38c], 3
jl 0x438a4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.gethostbyname_error____i
push 0x67d47c
jmp 0x438a45
movsx eax, word [esi + 0xa]
push eax
mov eax, dword [esi + 0xc]
push dword [eax]
lea eax, [ebp - 0x8c8]
push eax
call fcn.00578180
add esp, 0xc
push 0x10
lea eax, [ebp - 0x8cc]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, ebx
jne 0x438bb8
xor bl, bl
push dword [ebp - 0x94c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x920]
call fcn.0040856e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040856e
mov al, bl
jmp 0x438a6b
push 0x67d494
lea eax, [ebp + 8]
push eax
call fcn.00425f36
push dword [0x6d68b4]
lea eax, [ebp + 8]
push eax
call fcn.00425f36
mov esi, 0x100000
push esi
call fcn.00573b6f
pop ecx
push esi
mov ebx, eax
push 0
push ebx
call fcn.005780d0
pop ecx
pop ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 6
lea eax, [ebp - 0x90c]
push eax
mov byte [ebp - 4], 1
call fcn.004040c2
pop ecx
pop ecx
mov byte [ebp - 4], 7
mov eax, dword [eax]
mov edx, ebx
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x438c1e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90c]
call fcn.0040842d
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x438c3c
sub eax, esi
xor esi, esi
mov edi, eax
mov dword [ebp - 0x908], esi
push 0
push edi
lea eax, [esi + ebx]
push eax
push dword [ebp - 0x94c]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x438c89
mov byte [ebp - 0x8f5], 1
cmp eax, 0xffffffff
je 0x438c89
add esi, eax
cmp eax, edi
je 0x438c89
sub edi, eax
inc dword [ebp - 0x908]
cmp dword [ebp - 0x908], 0xa
jl 0x438c4f
push ebx
call fcn.00573a92
xor edi, edi
pop ecx
cmp esi, edi
je 0x439e02
cmp byte [ebp + 0xc], 0
je 0x439e02
push dword [ebp - 0x94c]
lea eax, [ebp - 0x924]
push eax
call fcn.004387da
mov byte [ebp - 4], 8
xor ebx, ebx
inc ebx
cmp dword [0x6bc38c], ebx
jl 0x438d1f
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
lea ecx, [ebp - 0x924]
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 9
lea eax, [ebp - 0x90c]
push eax
mov byte [ebp - 4], 8
call fcn.004040c2
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
mov esi, eax
call fcn.004084c0
push eax
push str.Receive_data:__s
push 0x67d4ac
push ebx
call fcn.00532652
add esp, 0x10
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x90c]
call fcn.0040842d
mov eax, dword [ebp - 0x924]
cmp dword [eax - 0xc], edi
jle 0x439df3
push str.set_keywords:
xor ecx, ecx
lea esi, [ebp - 0x924]
call fcn.00426092
test eax, eax
jne 0x4390b6
mov eax, esi
push eax
lea eax, [ebp - 0x900]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0xb
push 0x67d4e0
xor ecx, ecx
lea esi, [ebp - 0x900]
call fcn.00426092
inc eax
mov ecx, esi
call fcn.00425ee5
lea eax, [ebp - 0xa74]
push eax
call fcn.0043489a
mov byte [ebp - 4], 0xc
push ecx
mov esi, esp
mov dword [ebp - 0x8fc], esp
push ecx
mov eax, esp
mov dword [ebp - 0x90c], esp
lea ecx, [ebp - 0x900]
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 0xd
push esi
mov byte [ebp - 4], 0xc
call fcn.004040c2
pop ecx
pop ecx
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0xa74]
push eax
mov byte [ebp - 4], 0xc
call fcn.0043495f
call fcn.00431a95
mov ebx, eax
cmp ebx, edi
je 0x439051
mov eax, dword [ebx]
lea ecx, [ebp - 0xa74]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov eax, dword [ebp - 0x9f4]
mov eax, dword [eax]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0xa0c]
lea edi, [ebp - 0x910]
lea esi, [ebp - 0x91c]
mov dword [ebp - 0x910], eax
call fcn.0040ad09
test al, al
jne 0x438eb6
push 0xa7
mov byte [ebp - 0xbc], al
lea eax, [ebp - 0xbb]
push 0
push eax
call fcn.005780d0
add esp, 0xc
lea eax, [ebp - 0xbc]
push eax
call fcn.0043e79b
push ecx
add eax, 4
mov ecx, esp
mov dword [ebp - 0x8fc], esp
push eax
push ecx
call fcn.0040fbdb
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0xc
call fcn.0041f847
pop ecx
pop ecx
push 0xa8
lea eax, [ebp - 0xbc]
push eax
call fcn.0043e79b
push ecx
mov ecx, esp
mov dword [ebp - 0x8fc], esp
push eax
push ecx
call fcn.0040fbdb
mov byte [ebp - 4], 0x10
mov eax, dword [ebx]
add eax, 0xc
mov byte [ebp - 4], 0xc
mov ecx, ebx
call dword [eax]
call fcn.004304dd
jmp 0x438dff
lea eax, [ebp - 0x8ec]
push eax
call fcn.0040f7de
mov byte [ebp - 4], 0x11
push 0
lea ecx, [ebp - 0x8ec]
call fcn.004100b3
test al, al
je 0x439041
lea eax, [ebp - 0x8ec]
push eax
call fcn.004117b0
mov eax, dword [ebp - 0xa64]
sub eax, dword [ebp - 0xa68]
mov ecx, 0x218
cdq
idiv ecx
and dword [ebp - 0x8f0], 0
test eax, eax
jbe 0x438f55
push dword [ebp - 0x8f0]
lea esi, [ebp - 0xa74]
call fcn.0043c20b
sub esp, 0x218
mov esi, eax
mov edi, esp
mov ecx, 0x86
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x8ec]
call fcn.00411701
mov eax, dword [ebp - 0xa64]
sub eax, dword [ebp - 0xa68]
mov ecx, 0x218
cdq
idiv ecx
inc dword [ebp - 0x8f0]
cmp dword [ebp - 0x8f0], eax
jb 0x438f06
mov eax, dword [ebp - 0xa14]
mov eax, dword [eax]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0xa14]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0xa2c]
lea edi, [ebp - 0x910]
lea esi, [ebp - 0x91c]
mov dword [ebp - 0x910], eax
call fcn.0040ad09
test al, al
jne 0x438fd3
call fcn.0043e79b
movzx eax, byte [eax + 4]
push eax
call fcn.0043e79b
push ecx
mov ecx, esp
mov dword [ebp - 0x8fc], esp
push eax
push ecx
call fcn.0040fbdb
mov byte [ebp - 4], 0x12
mov eax, dword [ebx]
add eax, 0x10
mov byte [ebp - 4], 0x11
mov ecx, ebx
call dword [eax]
call fcn.004304dd
jmp 0x438f6f
push dword [ebp - 0x9dc]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0x6c03c4
call esi
push dword [ebp - 0x9dc]
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
push 0x67d4e4
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x11
call fcn.0042c986
push dword [ebp - 0x9d8]
push 0x6c03c8
call esi
push dword [ebp - 0x9d8]
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
push str.ShowBandwidth100p
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x11
call fcn.0042c986
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x8ec]
push eax
call fcn.0040f80a
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0xa0c]
push eax
call fcn.0042d50e
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0xa2c]
push eax
call fcn.00435446
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0xa44]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0xa5c]
push eax
call fcn.0043c1cc
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xa74]
push eax
call fcn.0043c1cc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x900]
call fcn.0040856e
jmp 0x439df3
lea eax, [ebp - 0x988]
push eax
call fcn.0044e552
mov byte [ebp - 4], 0x1a
lea esi, [ebp - 0x924]
call fcn.004087a8
push eax
lea esi, [ebp - 0x9d4]
call fcn.00408187
mov byte [ebp - 4], 0x1b
push 0x3b
lea edx, [ebp - 0x988]
mov ecx, esi
call fcn.0041d197
pop ecx
mov byte [ebp - 4], 0x1a
push edi
push ebx
call fcn.00409bbf
mov eax, dword [ebp - 0x978]
sub eax, dword [ebp - 0x97c]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x908], edi
test eax, eax
jbe 0x439de3
push dword [ebp - 0x908]
lea esi, [ebp - 0x988]
call fcn.00409466
cmp dword [eax + 0x18], 8
jb 0x439138
mov eax, dword [eax + 4]
jmp 0x43913b
add eax, 4
push eax
lea eax, [ebp - 0x8f0]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x8f0]
cmp dword [eax - 0xc], edi
je 0x439db0
push str.Quick_Scan
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x4391a5
call fcn.00455f7a
push edi
push edi
push ebx
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x8f4], esp
push 0x67d544
push eax
call fcn.0040f884
mov byte [ebp - 4], 0x1d
push esi
mov byte [ebp - 4], 0x1c
call fcn.0045d97c
push eax
mov ecx, esi
call fcn.00465cb1
push str.Full_Scan
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x4391ef
call fcn.00455f7a
push edi
push edi
push ebx
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x8f4], esp
push str.Full
push eax
call fcn.0040f884
mov byte [ebp - 4], 0x1e
push esi
mov byte [ebp - 4], 0x1c
call fcn.0045d97c
push eax
mov ecx, esi
call fcn.00465cb1
push str.Custom_Scan
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x439277
mov eax, esi
push eax
lea eax, [ebp - 0x900]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x1f
push 0x67d580
xor ecx, ecx
lea esi, [ebp - 0x900]
call fcn.00426092
inc eax
mov ecx, esi
call fcn.00425ee5
call fcn.00455f7a
push edi
push edi
push ebx
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x8f4], esp
lea ecx, [ebp - 0x900]
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x20
push esi
mov byte [ebp - 4], 0x1f
call fcn.0045d97c
push eax
mov ecx, esi
call fcn.00465cb1
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x900]
call fcn.0040856e
push 0x67d584
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x4392a9
call fcn.00455f7a
push edi
call fcn.004613cc
mov ecx, dword [0x6d6410]
add ecx, 0xc0
call fcn.0046c96a
push str.Device_Block
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x4392db
call fcn.00455f7a
push ebx
call fcn.004613cc
mov ecx, dword [0x6d6410]
add ecx, 0xc0
call fcn.0046c96a
push str.fw_enable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x439302
call fcn.00431a95
cmp eax, edi
je 0x439302
mov edx, dword [eax]
push ebx
mov ecx, eax
call dword [edx + 4]
push str.fw_disable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x439329
call fcn.00431a95
cmp eax, edi
je 0x439329
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 4]
push str.ssl_enable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x439377
push ebx
push 0x6c03e4
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push dword [0x6c03e4]
push ecx
mov eax, esp
mov dword [ebp - 0x8f4], esp
push 0x67d600
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x1c
call fcn.0042c986
call fcn.00431f2a
push str.ssl_disable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x4393c5
push edi
push 0x6c03e4
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push dword [0x6c03e4]
push ecx
mov eax, esp
mov dword [ebp - 0x8f4], esp
push str.EnableSSL
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x1c
call fcn.0042c986
call fcn.00431f2a
push str.USB_Protection:
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x43976b
lea eax, [ebp - 0x9a0]
push eax
call fcn.00413cf5
mov byte [ebp - 4], 0x23
or dword [ebp - 0x8f4], 0xffffffff
or dword [ebp - 0x914], 0xffffffff
or dword [ebp - 0x930], 0xffffffff
mov eax, esi
push eax
lea eax, [ebp - 0x954]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x9b8]
push eax
call fcn.0044e552
mov byte [ebp - 4], 0x25
lea esi, [ebp - 0x954]
call fcn.004087a8
push eax
lea esi, [ebp - 0xa90]
call fcn.00408187
mov byte [ebp - 4], 0x26
push 0xd
lea edx, [ebp - 0x9b8]
mov ecx, esi
call fcn.0041d197
pop ecx
mov byte [ebp - 4], 0x25
push edi
push ebx
call fcn.00409bbf
mov eax, dword [ebp - 0x9a8]
sub eax, dword [ebp - 0x9ac]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x904], edi
test eax, eax
jbe 0x4396f8
push dword [ebp - 0x904]
lea esi, [ebp - 0x9b8]
call fcn.00409466
cmp dword [eax + 0x18], 8
jb 0x439499
mov eax, dword [eax + 4]
jmp 0x43949c
add eax, 4
push eax
lea eax, [ebp - 0x948]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x948]
call fcn.00426126
lea eax, [ebp - 0x970]
push eax
call fcn.0044e552
mov byte [ebp - 4], 0x28
lea esi, [ebp - 0x948]
call fcn.004087a8
push eax
lea esi, [ebp - 0x8e8]
call fcn.00408187
mov byte [ebp - 4], 0x29
push 0x3a
lea edx, [ebp - 0x970]
mov ecx, esi
call fcn.0041d197
pop ecx
mov byte [ebp - 4], 0x28
push edi
push ebx
call fcn.00409bbf
mov eax, dword [ebp - 0x960]
sub eax, dword [ebp - 0x964]
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, 2
jne 0x439670
push str.USB_Protection
push edi
lea esi, [ebp - 0x970]
call fcn.00409466
call fcn.0041b287
pop ecx
test al, al
je 0x439555
push ebx
call fcn.00409466
cmp dword [eax + 0x18], 8
jb 0x439545
mov eax, dword [eax + 4]
jmp 0x439548
add eax, 4
push eax
call fcn.00573a87
pop ecx
mov dword [ebp - 0x8f4], eax
push str.delay
push edi
lea esi, [ebp - 0x970]
call fcn.00409466
call fcn.0041b287
pop ecx
test al, al
je 0x439591
push ebx
call fcn.00409466
cmp dword [eax + 0x18], 8
jb 0x439581
mov eax, dword [eax + 4]
jmp 0x439584
add eax, 4
push eax
call fcn.00573a87
pop ecx
mov dword [ebp - 0x914], eax
push str.password
push edi
lea esi, [ebp - 0x970]
call fcn.00409466
call fcn.0041b287
pop ecx
test al, al
je 0x4395bd
push ebx
call fcn.00409466
call fcn.00438984
mov dword [ebp - 0x930], eax
push str.excluded
push edi
lea esi, [ebp - 0x970]
call fcn.00409466
call fcn.0041b287
pop ecx
test al, al
je 0x439670
push 0x67d6b4
lea eax, [ebp - 0x958]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x2a
push ebx
call fcn.00409466
cmp dword [eax + 0x18], 8
jb 0x439602
mov eax, dword [eax + 4]
jmp 0x439605
add eax, 4
push eax
lea eax, [ebp - 0x950]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x958]
push eax
push 0x2c
lea ecx, [ebp - 0x950]
lea edi, [ebp - 0x9d0]
call fcn.00470390
pop ecx
pop ecx
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x9a0]
call fcn.0043c25e
mov byte [ebp - 4], 0x2b
mov eax, edi
push eax
call fcn.00413877
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x950]
call fcn.0040856e
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x958]
call fcn.0040856e
xor ebx, ebx
inc ebx
xor edi, edi
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x970]
push eax
call fcn.0043c89d
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x948]
call fcn.0040856e
mov eax, dword [ebp - 0x9a8]
sub eax, dword [ebp - 0x9ac]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x904]
cmp dword [ebp - 0x904], eax
jb 0x43947d
cmp dword [ebp - 0x930], 0xffffffff
je 0x4396cd
call fcn.00455f7a
push dword [ebp - 0x930]
push eax
call fcn.00462a4e
cmp dword [ebp - 0x8f4], 0xffffffff
je 0x4396f8
cmp dword [ebp - 0x914], 0xffffffff
je 0x4396f8
call fcn.00455f7a
push dword [ebp - 0x914]
mov ecx, eax
push dword [ebp - 0x8f4]
push ebx
call fcn.00462556
call fcn.00455f7a
mov ebx, eax
mov eax, dword [ebp - 0x990]
sub eax, dword [ebp - 0x994]
sar eax, 2
test eax, eax
jbe 0x439737
lea esi, [ebp - 0x9a0]
call fcn.004138a1
push eax
call fcn.0046274a
mov eax, dword [ebp - 0x990]
sub eax, dword [ebp - 0x994]
inc edi
sar eax, 2
cmp edi, eax
jb 0x439712
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x9b8]
push eax
call fcn.0043c89d
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x954]
call fcn.0040856e
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x9a0]
push eax
call fcn.00413877
xor ebx, ebx
xor edi, edi
inc ebx
push 0x67d6b8
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x4397ec
mov eax, esi
push eax
lea eax, [ebp - 0x934]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x2d
push 0x67d6d8
xor ecx, ecx
lea esi, [ebp - 0x934]
call fcn.00426092
inc eax
mov ecx, esi
call fcn.00425ee5
push ecx
mov eax, esp
mov dword [ebp - 0x8f4], esp
mov ecx, esi
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0x2d
call fcn.0041cac0
pop ecx
mov esi, eax
call fcn.00455f7a
push esi
mov ecx, eax
call fcn.00462683
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x934]
call fcn.0040856e
push 0x67d6dc
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x43986d
mov eax, esi
push eax
lea eax, [ebp - 0x93c]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x2f
push 0x67d700
xor ecx, ecx
lea esi, [ebp - 0x93c]
call fcn.00426092
inc eax
mov ecx, esi
call fcn.00425ee5
push ecx
mov eax, esp
mov dword [ebp - 0x8f4], esp
mov ecx, esi
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x2f
call fcn.0041cac0
pop ecx
mov esi, eax
call fcn.00455f7a
push esi
mov ecx, eax
call fcn.004628d0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x93c]
call fcn.0040856e
push 0x67d704
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
je 0x4398c7
push str.opt_scan
xor ecx, ecx
call fcn.00426092
test eax, eax
je 0x4398c7
push str.opt_update
xor ecx, ecx
call fcn.00426092
test eax, eax
je 0x4398c7
push str.opt_sch
xor ecx, ecx
call fcn.00426092
test eax, eax
je 0x4398c7
push str.opt_logs
xor ecx, ecx
call fcn.00426092
test eax, eax
jne 0x439b63
lea eax, [ebp - 0x8f0]
push eax
lea eax, [ebp - 0x938]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x31
push 0x67d768
xor ecx, ecx
lea esi, [ebp - 0x938]
call fcn.00426092
inc eax
mov ecx, esi
call fcn.00425ee5
mov eax, esi
push eax
call fcn.0040414b
mov eax, dword [0x6d67ec]
sub eax, dword [0x6d67e8]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x439b54
mov ecx, dword [0x6d6410]
add ecx, 0xc0
call fcn.0046c894
call fcn.00401cb3
mov eax, dword [0x6d67ec]
sub eax, dword [0x6d67e8]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x904], edi
cmp eax, edi
jbe 0x439b2d
and dword [ebp - 0x8f4], 0
cmp edi, eax
jb 0x43995e
call fcn.005741fa
mov eax, dword [0x6d67e8]
mov ecx, dword [ebp - 0x8f4]
lea edi, [eax + ecx]
mov eax, dword [edi]
test eax, eax
jne 0x439989
movzx edx, byte [edi + 0xc]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.0040191b
jmp 0x439b03
cmp eax, 1
jne 0x4399a3
push dword [edi + 0x10]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
call fcn.0040178a
jmp 0x439b03
cmp eax, 2
jne 0x4399d4
push ecx
lea eax, [edi + 0x14]
mov ecx, esp
mov dword [ebp - 0x914], esp
push eax
call fcn.0040102d
mov byte [ebp - 4], 0x32
mov eax, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push edi
mov byte [ebp - 4], 0x31
call fcn.00401ab1
jmp 0x439b03
cmp eax, 3
jne 0x439b03
push 0x67d76c
lea ebx, [edi + 4]
push ebx
call fcn.00416c0e
test eax, eax
jne 0x439ac0
lea eax, [edi + 8]
push 0x67d778
push eax
mov dword [ebp - 0x914], eax
call fcn.00416c0e
test eax, eax
jne 0x439ac0
push ecx
mov ecx, esp
mov dword [ebp - 0x930], esp
call fcn.004010c4
mov byte [ebp - 4], 0x33
push ecx
mov dword [ebp - 0x918], esp
mov esi, esp
push 0xffffffffffffffff
push str.RealtimeNew
call fcn.004bb9d0
pop ecx
pop ecx
mov dword [esi], eax
mov byte [ebp - 4], 0x34
push 0x67d790
lea eax, [ebp - 0x940]
push eax
mov byte [ebp - 4], 0x31
call fcn.004012ef
mov byte [ebp - 4], 0x35
add edi, 0x18
push edi
lea ecx, [ebp - 0x940]
call fcn.0043ccc5
push ecx
lea eax, [ebp - 0x940]
mov ecx, esp
mov dword [ebp - 0x918], esp
push eax
call fcn.004010ed
mov byte [ebp - 4], 0x36
mov esi, dword [ebp - 0x914]
call fcn.004084c0
push ecx
mov dword [ebp - 0x914], esp
mov esi, esp
push 0xffffffffffffffff
push eax
call fcn.004bb9d0
pop ecx
pop ecx
mov dword [esi], eax
mov byte [ebp - 4], 0x37
mov ebx, dword [ebx]
push ebx
mov byte [ebp - 4], 0x35
call fcn.004015a5
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x940]
call fcn.00401113
jmp 0x439b03
push ecx
lea eax, [edi + 0x18]
mov ecx, esp
mov dword [ebp - 0x918], esp
push eax
call fcn.004010ed
mov byte [ebp - 4], 0x38
lea esi, [edi + 8]
call fcn.004084c0
push ecx
mov dword [ebp - 0x914], esp
mov esi, esp
push 0xffffffffffffffff
push eax
call fcn.004bb9d0
pop ecx
pop ecx
mov dword [esi], eax
mov byte [ebp - 4], 0x39
mov ebx, dword [ebx]
push ebx
mov byte [ebp - 4], 0x31
call fcn.004015a5
mov eax, dword [0x6d67ec]
sub eax, dword [0x6d67e8]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x904]
add dword [ebp - 0x8f4], 0x1c
cmp dword [ebp - 0x904], eax
jb 0x43995e
call fcn.00401cb3
mov ecx, dword [0x6d6410]
add ecx, 0xc0
call fcn.0046c894
call fcn.00455f7a
mov ecx, eax
call fcn.0045df15
xor ebx, ebx
xor edi, edi
inc ebx
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x938]
call fcn.0040856e
push str.opt_pass
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x439c6b
mov eax, esi
push eax
lea eax, [ebp - 0x92c]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x3a
push 0x67d7b0
xor ecx, ecx
lea esi, [ebp - 0x92c]
call fcn.00426092
inc eax
mov ecx, esi
call fcn.00425ee5
mov ecx, dword [0x6d6410]
add ecx, 0xc0
call fcn.0046c894
call fcn.00401cb3
push ebx
push 0x67d7b4
push 0x67d7bc
call fcn.0040191b
push dword [ebp - 0x92c]
call fcn.00573a87
pop ecx
push eax
push str.Password
push 0x67d7d0
mov dword [ebp - 0x8fc], eax
call fcn.0040178a
push dword [0x6d6628]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp eax, edi
je 0x439c46
lea eax, [ebp - 0x944]
push eax
push 2
mov dword [ebp - 0x944], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
cmp dword [ebp - 0x944], edi
je 0x439c40
push 4
lea eax, [ebp - 0x8fc]
push eax
push 4
push str.SP01
push str.SoftwareMicrosoftShared
push dword [ebp - 0x944]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
call fcn.00401cb3
mov ecx, dword [0x6d6410]
add ecx, 0xc0
call fcn.0046c894
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x92c]
call fcn.0040856e
push str.Download_Updates
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x439c93
call fcn.00455f7a
push edi
mov ebx, eax
call fcn.0045d925
xor ebx, ebx
inc ebx
xor edi, edi
push str.Uninstall_Client
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426092
test eax, eax
jne 0x439db0
cmp dword [0x6d6628], edi
je 0x439d93
lea eax, [ebp - 0x928]
push eax
call fcn.004084d7
mov byte [ebp - 4], 0x3b
push dword [0x6d6628]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x8bc]
push eax
push edi
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallVibranium_Advanced_Security_is1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x90c], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x439d2c
mov eax, dword [ebp - 0x90c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x8bc], cx
lea eax, [ebp - 0x8bc]
push eax
lea eax, [ebp - 0x928]
push eax
call fcn.004085d2
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x928]
cmp dword [eax - 0xc], edi
je 0x439d82
mov esi, dword [0x6d6628]
push ecx
mov eax, esp
mov dword [ebp - 0x918], esp
push str._VERYSILENT
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x3c
push ecx
mov eax, esp
mov dword [ebp - 0x8f4], esp
lea ecx, [ebp - 0x928]
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x3b
mov ecx, esi
call fcn.0043888e
pop ecx
pop ecx
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x928]
call fcn.0040856e
jmp 0x439db0
cmp dword [0x6bc38c], 3
jl 0x439db0
push str.User_token_is_not_available
push str.Reporter::SendReport
push 3
call fcn.00532652
add esp, 0xc
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x8f0]
call fcn.0040856e
mov eax, dword [ebp - 0x978]
sub eax, dword [ebp - 0x97c]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x908]
cmp dword [ebp - 0x908], eax
jb 0x43911c
mov byte [ebp - 4], 8
lea eax, [ebp - 0x988]
push eax
call fcn.0043c89d
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x924]
call fcn.0040856e
mov bl, byte [ebp - 0x8f5]
jmp 0x438b8a