Function at 0x413909
Capabilities:
Contain obfuscated stackstrings
Create thread
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x474ea0]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 0x30
mov eax, 0x45380a
call fcn.0043874e
xor esi, esi
push 8
mov ebx, ecx
lea eax, [ebp - 0x3c]
push esi
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebx + 0xcaac], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], esi
call fcn.004376f0
add esp, 0xc
mov dword [ebp - 0x28], esi
call fcn.00423024
push eax
lea ecx, [ebp - 0x10]
call fcn.00421c70
lea ecx, [ebp - 0x24]
mov eax, 0x400
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
mov byte [ebp + 0x100], 0x40
mov byte [ebp + 0x101], 0x60
mov byte [ebp + 0x102], 0x8f
mov byte [ebp + 0x103], 0xc6
mov byte [ebp + 0x104], 0xea
mov byte [ebp + 0x105], 0x8a
mov byte [ebp + 0x106], 0x21
mov byte [ebp + 0x107], 0x47
mov byte [ebp + 0x108], 0x12
mov byte [ebp + 0x109], 0xa4
mov byte [ebp + 0x10a], 0x97
mov byte [ebp + 0x10b], 0x7a
mov byte [ebp + 0x10c], 0x61
mov byte [ebp + 0x10d], 0xac
mov byte [ebp + 0x10e], 0xc
mov byte [ebp + 0x10f], 0xa1
mov byte [ebp + 0x110], 0x61
mov byte [ebp + 0x111], 0xd4
mov byte [ebp + 0x112], 0x3e
mov byte [ebp + 0x113], 0x49
mov byte [ebp + 0x114], 0xe0
mov byte [ebp + 0x115], 0x9b
mov byte [ebp + 0x116], 4
mov byte [ebp + 0x117], 0x57
mov byte [ebp + 0x118], 0xa6
mov byte [ebp + 0x119], 0x99
mov byte [ebp + 0x11a], 0xb5
mov byte [ebp + 0x11b], 0xd8
mov byte [ebp + 0x11c], 9
mov byte [ebp + 0x11d], 0x56
mov byte [ebp + 0x11e], 0xac
mov byte [ebp + 0x11f], 5
mov dword [ebp - 0x24], eax
call fcn.00409312
push eax
push 0x20
lea eax, [ebp + 0x100]
push eax
push str.a12dc3cr32
call fcn.0040d5ac
add esp, 0x14
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004091a3
mov edi, 0xff
push edi
lea eax, [ebp]
push eax
lea ecx, [ebx + 0xcab0]
call fcn.00417b9c
push 0x459b8c
lea ecx, [ebp - 0x10]
call fcn.00411615
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00411615
push edi
lea eax, [ebp]
push esi
push eax
call fcn.004376f0
push dword [ebp + 0x12c]
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
push 1
push edi
push reloc.WSOCK32.dll_bind
mov dword [ebp - 0x18], esi
call fcn.004095df
add esp, 0x20
push dword [edi - 0xc]
lea ecx, [ebp - 0x10]
push esi
mov ebx, eax
call fcn.0040f8c5
push eax
call fcn.004376f0
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004091a3
cmp ebx, esi
jne 0x413cd0
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push esi
push str.data
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, 0x459b88
jne 0x413c3e
lea eax, [ebp - 0x2c]
push eax
push esi
push esi
push esi
push ebx
push dword [ebp - 0x1c]
call edi
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.0041ab3d
pop ecx
lea ecx, [ebp - 0x2c]
push ecx
push eax
push esi
push esi
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call edi
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push esi
push ebx
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp - 0x28]
inc eax
push eax
call fcn.0041ab3d
pop ecx
lea ecx, [ebp - 0x28]
push ecx
push eax
push esi
push esi
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
call edi
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0x110]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.00412684
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x110]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringA]
call fcn.00423024
push eax
lea ecx, [ebp - 0x14]
call fcn.00421c70
push dword [ebp - 0x34]
lea eax, [ebp - 0x14]
push str.CLSID_s
push eax
mov byte [ebp - 4], 1
call fcn.004095cc
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeA]
lea ecx, [ebp - 0x14]
call fcn.00410cec
push dword [ebp - 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp + 0x12c]
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebp - 0x14]
push bind
call fcn.004095df
add esp, 0x14
test eax, eax
je 0x413c88
mov ecx, ebx
call fcn.004111a7
jmp 0x413ca4
cmp dword [ebp + 0x12c], esi
jne 0x413b51
mov ecx, dword [ebp - 0x14]
push 1
call fcn.00413909
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00409012
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.004377fb
add ebp, 0x124
leave
ret 4
lea eax, [ebx + 0xc92c]
push eax
push esi
push ebx
push 0x413051
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0xc928], eax
push dword [ebp - 0x24]
call edi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00409012
cmp dword [ebp - 0x20], esi
je 0x413cc2
push dword [ebp - 0x20]
call fcn.0041ab38
pop ecx
cmp dword [ebp - 0x30], esi
je 0x413cd0
push dword [ebp - 0x30]
call fcn.0041ab38
pop ecx
xor esi, esi
inc esi
jmp 0x413c56