Function at 0x46c420
Capabilities:
Get common file path
Get installed programs
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb3c
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0xb28], ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xb18]
mov dword [ebp - 0xb2c], ebx
call fcn.0047aa50
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x20c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x46c470
mov ecx, dword [str.ModemLog_]
mov edx, dword [0x5d976c]
mov dword [eax], ecx
mov cx, word [0x5d9770]
mov dword [eax + 4], edx
mov dl, byte [0x5d9772]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
mov eax, ebx
mov ecx, ebx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c4a1
lea edi, [ebp - 0x20c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46c4b3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x20c]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x46c4d0
mov ecx, dword [str..txt]
mov dl, byte [0x5d9764]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [ebp - 0x20c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c4f2
mov ecx, dword [ebp - 0xb28]
sub eax, edx
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push str.LoggingPath
call fcn.00427440
lea edx, [ebp - 0x20c]
mov eax, ebx
sub edx, ebx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x46c520
lea eax, [ebp - 0x20c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x46c531
mov si, word [0x5d9750]
mov bl, byte [0x5d9752]
mov edi, dword [ebp - 0xb28]
mov word [eax], si
mov byte [eax + 2], bl
lea eax, [edi + 0x30]
lea edx, [ebp - 0x518]
mov dword [ebp - 0xb34], eax
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x46c563
lea eax, [ebp - 0x518]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x46c574
lea ecx, [ebp - 0xb24]
push ecx
lea edx, [ebp - 0x108]
push edx
mov word [eax], si
push str.Manufacturer
mov ecx, edi
mov byte [eax + 2], bl
mov dword [ebp - 0xb24], 0x104
call fcn.00427220
test eax, eax
je 0x46c7b6
lea eax, [ebp - 0x108]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c5b6
lea edi, [ebp - 0x20c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46c5c6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x20c]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x46c5e5
mov bx, word [0x5d9750]
mov cl, byte [0x5d9752]
mov word [eax], bx
mov byte [eax + 2], cl
lea eax, [ebp - 0x108]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c608
lea edi, [ebp - 0x518]
sub eax, ecx
mov esi, ecx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46c620
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x518]
rep movsb byte es:[edi], byte [esi]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x46c640
mov dl, byte [0x5d9752]
mov word [eax], bx
mov ebx, dword [ebp - 0xb28]
mov byte [eax + 2], dl
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0x108]
push ecx
push str.ProviderName
mov ecx, ebx
mov dword [ebp - 0xb24], 0x104
call fcn.00427220
test eax, eax
je 0x46c7b6
lea eax, [ebp - 0x108]
mov edx, eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c690
lea edi, [ebp - 0x20c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46c6a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x108]
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c6c0
lea edi, [ebp - 0x518]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46c6d2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x20c]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c6f1
sub eax, edx
push eax
lea edx, [ebp - 0x20c]
push edx
push 1
push str.ResponsesKeyName
mov ecx, ebx
call fcn.00427440
mov ecx, 0x10
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUnimodemDeviceSpecific_
lea edi, [ebp - 0x824]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x518]
movsb byte es:[edi], byte [esi]
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c730
lea edi, [ebp - 0x824]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46c742
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x10
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUnimodemDeviceSpecific_
lea edi, [ebp - 0x720]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x20c]
movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c775
lea edi, [ebp - 0x720]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46c787
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x720]
push eax
lea ecx, [ebp - 0x824]
push ecx
lea ecx, [ebp - 0xb18]
call fcn.0047bca0
mov eax, dword [ebp - 0xb2c]
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c7c0
mov edx, dword [ebp - 0xb2c]
sub eax, ecx
push eax
push edx
push str.Friendly_Name
push str.SOFTWAREMicrosoftRasTapi_DevicesUnimodem
lea ecx, [ebp - 0xb18]
call fcn.0047b0f0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xb20]
push eax
push 0x20019
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea edi, [ebp - 0x414]
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [ebp - 0x414]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x46c99d
mov eax, dword [ebp - 0xb20]
push 0x104
lea edx, [ebp - 0x108]
push edx
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x46c98a
inc ebx
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x414]
mov byte [ebp + eax - 0x310], cl
inc eax
test cl, cl
jne 0x46c850
lea edi, [ebp - 0x310]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46c870
mov cx, word [0x5cd28c]
lea eax, [ebp - 0x108]
mov word [edi], cx
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c890
lea edi, [ebp - 0x310]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46c8a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0xb1c]
push edx
push 0xf003f
mov ecx, eax
push 0
lea eax, [ebp - 0x310]
push eax
and ecx, 3
push reloc.OLEAUT32.dll_SysReAllocString
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46c968
lea ecx, [ebp - 0xb24]
push ecx
lea edx, [ebp - 0x108]
push edx
push eax
push eax
mov eax, dword [ebp - 0xb1c]
push str.DisplayName
push eax
mov dword [ebp - 0xb24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46c95b
mov ecx, dword [ebp - 0xb34]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.00599e8d
add esp, 8
test eax, eax
jne 0x46c95b
mov esi, dword [ebp - 0xb2c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c935
sub eax, edx
push eax
mov eax, dword [ebp - 0xb1c]
push esi
push 1
push 0
push str.DisplayName
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, 0xff
mov ecx, dword [ebp - 0xb1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xb20]
push 0x104
lea edx, [ebp - 0x108]
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x46c846
mov ecx, dword [ebp - 0xb20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices
lea edi, [ebp - 0x414]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0xb20]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x414]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
movsw word es:[edi], word [esi]
call ebx
test eax, eax
jne 0x46cba2
mov edx, dword [ebp - 0xb20]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
xor ebx, ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x46cb8f
lea esp, [esp]
inc ebx
xor eax, eax
jmp 0x46ca10
mov cl, byte [ebp + eax - 0x414]
mov byte [ebp + eax - 0x310], cl
inc eax
test cl, cl
jne 0x46ca10
lea edi, [ebp - 0x310]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46ca30
mov ax, word [0x5cd28c]
mov word [edi], ax
lea eax, [ebp - 0x108]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46ca50
lea edi, [ebp - 0x310]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46ca60
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xb1c]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x310]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46caf5
mov edx, dword [ebp - 0xb1c]
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push str.DriverDesc
push edx
mov dword [ebp - 0xb24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46cae8
mov eax, dword [ebp - 0xb34]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00599e8d
add esp, 8
test eax, eax
je 0x46cb19
mov edx, dword [ebp - 0xb1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xb20]
push 0x104
lea eax, [ebp - 0x108]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x46ca00
jmp 0x46cb8f
mov esi, dword [ebp - 0xb2c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46cb24
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
mov edx, dword [ebp - 0xb1c]
push eax
push esi
push 1
push 0
push str.DriverDesc
push edx
call edi
mov eax, esi
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46cb50
sub eax, ecx
push eax
mov eax, dword [ebp - 0xb1c]
push esi
push 1
push 0
push str.FriendlyName
push eax
call edi
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46cb72
sub eax, ecx
mov ecx, dword [ebp - 0xb1c]
push eax
push esi
push 1
push 0
push str.Model
push ecx
call edi
mov edx, dword [ebp - 0xb20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 8
mov esi, str.SystemCurrentControlSetEnumPCI
lea edi, [ebp - 0x414]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xb20]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x414]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
movsw word es:[edi], word [esi]
call ebx
test eax, eax
jne 0x46cf02
push 0x104
lea edx, [ebp - 0x108]
push edx
push eax
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0xb20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x46ce6d
jmp 0x46cc10
inc dword [ebp - 0xb38]
cmp dword [ebp - 0xb28], 0
jne 0x46ce6d
xor eax, eax
jmp 0x46cc30
mov cl, byte [ebp + eax - 0x414]
mov byte [ebp + eax - 0x310], cl
inc eax
test cl, cl
jne 0x46cc30
lea edi, [ebp - 0x310]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46cc50
mov cx, word [0x5cd28c]
lea eax, [ebp - 0x108]
mov word [edi], cx
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46cc70
lea edi, [ebp - 0x310]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46cc80
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0xb1c]
push edx
push 0x20019
mov ecx, eax
push 0
lea eax, [ebp - 0x310]
push eax
and ecx, 3
push reloc.OLEAUT32.dll_SysReAllocString
rep movsb byte es:[edi], byte [esi]
call ebx
test eax, eax
jne 0x46ce45
mov edx, dword [ebp - 0xb1c]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
push edx
mov dword [ebp - 0xb30], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x46ce38
jmp 0x46ccf0
inc dword [ebp - 0xb30]
cmp dword [ebp - 0xb28], 0
jne 0x46ce38
xor eax, eax
jmp 0x46cd10
mov cl, byte [ebp + eax - 0x310]
mov byte [ebp + eax - 0x61c], cl
inc eax
test cl, cl
jne 0x46cd10
lea edi, [ebp - 0x61c]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46cd30
mov ax, word [0x5cd28c]
mov word [edi], ax
lea eax, [ebp - 0x108]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46cd50
lea edi, [ebp - 0x61c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46cd60
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xb3c]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x61c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x46ce10
mov edx, dword [ebp - 0xb3c]
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push str.DeviceDesc
push edx
mov dword [ebp - 0xb24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46ce03
mov eax, dword [ebp - 0xb34]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00599e8d
add esp, 8
test eax, eax
jne 0x46ce03
mov dword [ebp - 0xb28], 1
mov edi, edi
mov cl, byte [ebp + eax - 0x61c]
mov byte [ebp + eax - 0x20c], cl
inc eax
test cl, cl
jne 0x46cdf0
mov edx, dword [ebp - 0xb3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xb30]
mov edx, dword [ebp - 0xb1c]
push 0x104
lea eax, [ebp - 0x108]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x46ccf0
mov eax, dword [ebp - 0xb1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xb38]
mov eax, dword [ebp - 0xb20]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x46cc10
mov ecx, dword [ebp - 0xb20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xb28], 0
je 0x46cf02
push 0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x91c]
call fcn.0047aa50
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x91c]
call fcn.0047aa90
mov esi, dword [ebp - 0xb2c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46ceb2
sub eax, edx
push eax
push esi
push str.DeviceDesc
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x91c]
call fcn.0047b0f0
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46cee0
sub eax, edx
push eax
push esi
push str.FriendlyName
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x91c]
call fcn.0047b0f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 4