Function at 0x412dd0
Capabilities:
Check if file exists
Check os version
Copy file
Create process on windows
Delete registry value
Get common file path
Get file attributes
Persist via run registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60cc8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x13b0
call fcn.005de290
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], ebx
call fcn.00444af0
call fcn.00444cc0
mov ecx, esi
call fcn.00411300
mov ecx, esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x84], ebx
call fcn.004121c0
mov ecx, esi
call fcn.004126b0
cmp dword [0x6ec780], ebx
je 0x412e57
mov eax, dword [esi + 0x48]
mov cl, byte [eax + 0x3b]
test cl, cl
jne 0x412e52
mov cl, byte [eax + 0x3d]
test cl, cl
jne 0x412e52
cmp dword [0x6ec794], ebx
je 0x412e57
call fcn.0041d4a0
lea eax, [ebp - 0x19c]
mov edi, 1
push eax
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x19c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x412eba
cmp dword [ebp - 0x18c], 2
jne 0x412eba
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x2c], edi
cmp eax, 6
jb 0x412eba
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x7c], edi
call fcn.00412980
add esp, 4
push reloc.WS2_32.dll_bind
call fcn.00412980
add esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x78], 4
cmp eax, ebx
je 0x412f32
mov eax, dword [0x6ec7a0]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x78]
lea edx, [ebp - 0x64]
push ecx
push edx
push ebx
push ebx
push 0x6bd8d8
push eax
call edi
test eax, eax
jne 0x412eef
mov ecx, dword [ebp - 0x64]
mov dword [esi + 0x1c], ecx
mov ecx, dword [0x6ec7a0]
lea edx, [ebp - 0x78]
lea eax, [ebp - 0x64]
push edx
push eax
push ebx
push ebx
push 0x6bd8c4
push ecx
call edi
test eax, eax
jne 0x412f7d
cmp dword [ebp - 0x64], ebx
je 0x412f7d
lea edx, [ebp - 0x88]
lea eax, [ebp - 0x90]
push edx
push eax
lea ecx, [esi + 4]
call fcn.0040cd10
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [ebp - 0x18], ecx
jmp 0x412f7d
mov ecx, dword [0x6ec7a0]
lea edx, [ebp - 0x78]
lea eax, [ebp - 0x64]
push edx
push eax
push ebx
push ebx
push 0x6bd8c4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412f58
mov edx, dword [ebp - 0x64]
mov dword [esi + 0x1c], edx
cmp dword [esi + 0x1c], ebx
je 0x412f7d
lea eax, [ebp - 0x88]
lea ecx, [ebp - 0x90]
push eax
push ecx
lea ecx, [esi + 4]
call fcn.0040cd10
xor edx, edx
cmp eax, ebx
sete dl
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x88]
xor eax, eax
cmp ecx, ebx
sete al
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x413098
lea ecx, [ebp - 0x1c]
mov edi, 1
push ecx
push 0x20019
push ebx
push 0x6bbf94
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412fef
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x78]
lea eax, [ebp - 0x64]
push edx
push eax
push ebx
push ebx
push 0x6bd8ac
push ecx
mov dword [ebp - 0x78], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412fe5
mov edi, dword [ebp - 0x64]
mov dword [esi + 0x1c], edi
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 0x1c], ebx
jne 0x41304b
mov edx, dword [0x6ec7a0]
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x64]
push eax
push ecx
push ebx
push ebx
push 0x6bd89c
push edx
mov dword [ebp - 0x78], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x413043
mov eax, 1
push 4
mov dword [esi + 0x1c], eax
mov ecx, dword [0x6ec7a0]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 4
push ebx
push 0x6bd89c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x413046
mov dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ebx
je 0x413098
lea edx, [ebp - 0x28]
mov ecx, esi
push edx
call fcn.00414bc0
xor ecx, ecx
cmp eax, ebx
mov eax, dword [ebp - 0x28]
push 4
sete cl
xor edx, edx
cmp eax, ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [0x6ec7a0]
push eax
push 4
push ebx
sete dl
push 0x6bd8d8
push ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov ecx, esi
call fcn.0044dc60
cmp dword [0x6ec794], ebx
je 0x4130da
lea ecx, [ebp - 0x14]
call fcn.004ee720
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004ef740
cmp eax, ebx
je 0x4130ce
lea ecx, [ebp - 0x14]
call fcn.004ef700
cmp eax, ebx
jne 0x4130ce
push 1
lea ecx, [ebp - 0x14]
call fcn.004ee760
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004ee750
cmp dword [ebp - 0x74], ebx
jne 0x4130e8
cmp dword [ebp - 0x40], ebx
je 0x413372
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x54], 1
call fcn.004ee720
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004ef740
cmp eax, ebx
jne 0x41329c
cmp dword [0x6ec78c], ebx
jne 0x41312c
push ebx
lea ecx, [ebp - 0x14]
call fcn.004ee760
lea ecx, [ebp - 0x14]
call fcn.004ef650
lea ecx, [ebp - 0x14]
call fcn.004ef950
mov byte [ebp - 0x21], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
mov word [ebp - 0x5c], bx
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0041a9c0
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x60]
push edx
push eax
mov ecx, esi
call fcn.0041a150
cmp eax, ebx
je 0x4131c6
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x4131c2
xor ebx, ebx
cmp ebx, dword [esi + 0x28]
jge 0x4131c6
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx + ebx*4]
cmp eax, dword [edx + 8]
jne 0x41327e
xor edi, edi
mov eax, dword [esi + 0x24]
mov eax, dword [eax + ebx*4]
cmp edi, dword [eax + 0x1c]
jge 0x4131c6
mov ecx, dword [ebp - 0x60]
test ecx, ecx
jne 0x413190
lea ecx, [ebp - 0x5c]
mov edx, dword [eax + 0x18]
lea esi, [edi + edi*8]
shl esi, 2
push ecx
mov eax, dword [edx + esi]
push eax
call fcn.005e07bc
add esp, 8
test eax, eax
jne 0x413275
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x24]
mov edx, dword [ecx + ebx*4]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + esi + 8]
test ecx, ecx
je 0x4131c6
mov byte [ebp - 0x21], 0
mov al, byte [ebp - 0x21]
xor ebx, ebx
xor edi, edi
test al, al
je 0x413232
cmp dword [ebp - 0x2c], ebx
jne 0x413232
mov ecx, dword [0x6e7b6c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [0x6ed260]
mov eax, dword [0x6ed3d0]
push edx
push eax
lea ecx, [ebp - 0x1c]
push 0x6bd890
push ecx
mov byte [ebp - 4], 4
call fcn.005f368b
mov edx, dword [0x6ed40c]
mov eax, dword [ebp - 0x1c]
add esp, 0x10
push 0x50004
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x413222
mov edi, 1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.005fa859
cmp edi, ebx
jne 0x413284
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x44]
cmp eax, ebx
mov dword [ebp - 0x54], ebx
jne 0x413260
lea ecx, [ebp - 0x1c]
push 4
push ecx
mov dword [esi + 0x1c], ebx
mov edx, dword [0x6ec7a0]
push 4
push ebx
push 0x6bd8c4
push edx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov ecx, esi
call fcn.00419cf0
mov dword [0x6ec10c], 1
jmp 0x41328e
mov esi, dword [ebp - 0x44]
inc edi
jmp 0x41317b
inc ebx
jmp 0x413165
mov esi, dword [ebp - 0x44]
mov ecx, esi
call fcn.0041e680
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 2
call fcn.00401070
jmp 0x41330c
cmp dword [ebp - 0x7c], ebx
je 0x41330c
call fcn.00506890
mov edi, eax
cmp edi, ebx
je 0x41330c
mov edx, dword [0x6ec7a0]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x20]
push eax
push ecx
push ebx
push ebx
push 0x6bd880
push edx
mov dword [ebp - 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x413306
mov ecx, dword [0x6ec7a0]
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push ebx
push 0x6bd880
push ecx
mov dword [ebp - 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
push ebx
push ebx
push ebx
push edi
push 0x412d70
call fcn.005fae57
jmp 0x41330c
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
cmp dword [esi + 0x1c], ebx
je 0x413366
cmp dword [ebp - 0x2c], ebx
jne 0x413366
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x28]
push edx
push eax
push 1
lea ecx, [ebp - 0x14]
call fcn.004ef780
mov eax, dword [0x6ec7a0]
mov ecx, dword [ebp - 0x28]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x1c]
push 4
push edx
push 4
push ebx
push 0x6bd874
push eax
mov dword [ebp - 0x1c], ecx
call edi
mov eax, dword [0x6ec7a0]
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
push 4
push edx
push 4
push ebx
push 0x6bd868
push eax
mov dword [ebp - 0x1c], ecx
call edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004ee750
cmp dword [esi + 0x1c], ebx
je 0x4139af
mov edi, dword [ebp - 0x18]
cmp edi, ebx
jne 0x413499
cmp dword [ebp - 0x40], ebx
jne 0x413499
cmp dword [ebp - 0x2c], ebx
jne 0x413995
lea ecx, [ebp - 0x2a0]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x413480
mov edx, dword [0x6e7b6c]
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x2a0]
push 0x6bcc74
push eax
lea ecx, [ebp - 0x18]
push 0x6bcc6c
push ecx
mov byte [ebp - 4], 9
call fcn.005f368b
mov edx, dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x10
push edx
call edi
cmp eax, 0xffffffff
jne 0x413474
lea eax, [ebp - 0x2a0]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x413474
lea ecx, [ebp - 0x4a0]
lea edx, [ebp - 0x5a0]
push ecx
lea eax, [ebp - 0x3a0]
push edx
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x2a0]
push ecx
push edx
call fcn.005deb8a
add esp, 0x14
lea eax, [ebp - 0x3a0]
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x2a0]
push 0x6bcc74
push eax
push ecx
push 0x6bcc34
push edx
call fcn.005deb38
add esp, 0x14
lea eax, [ebp - 0x2a0]
push eax
call edi
cmp eax, 0xffffffff
je 0x413474
mov ecx, dword [ebp - 0x18]
push ebx
lea edx, [ebp - 0x2a0]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005fa859
cmp dword [ebp - 0x90], ebx
je 0x4139b4
lea ecx, [esi + 4]
call fcn.0040d240
jmp 0x4139b4
mov edx, dword [0x6ec7a0]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x8c]
push eax
push ecx
push ebx
push ebx
push 0x6bcd9c
push edx
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413504
cmp dword [ebp - 0x8c], 1
jne 0x413504
cmp dword [ebp - 0x2c], ebx
jne 0x413504
mov eax, dword [ebp - 0x74]
cmp eax, ebx
mov eax, 0x6ed420
jne 0x4134e2
mov eax, 0x6ed41c
mov ecx, dword [0x6ed428]
mov eax, dword [eax]
push 0x50004
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x413504
xor edi, edi
mov dword [ebp - 0x18], edi
jmp 0x413508
cmp edi, ebx
jne 0x413511
cmp dword [ebp - 0x40], ebx
je 0x413990
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ebx
cmp eax, ebx
je 0x413928
cmp dword [ebp - 0x40], ebx
je 0x413955
mov ecx, esi
call fcn.00417fa0
cmp dword [ebp - 0x7c], ebx
jne 0x41356d
push 1
mov ecx, esi
call fcn.00414f90
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
mov dword [0x6ec108], 1
mov ecx, esi
je 0x413560
call fcn.00414510
mov dword [ebp - 0x3c], ebx
jmp 0x41393b
call fcn.00414450
mov dword [ebp - 0x3c], ebx
jmp 0x41393b
xor edx, edx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], edx
mov word [ebp - 0x34], bx
mov edi, dword [0x6ec738]
mov byte [ebp - 4], 5
cmp edi, ebx
jne 0x41358c
mov edi, 0x6ec73c
mov eax, 0x6bc11c
test eax, eax
je 0x4136b0
cmp edi, ebx
je 0x4136b0
mov ecx, 0x6bd84c
test ecx, ecx
je 0x4136b0
xor ebx, ebx
lea ecx, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x4c], bx
call fcn.00402d00
push edi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 6
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], ebx
mov word [ebp - 0x6c], bx
call fcn.004023e0
push 0x6bd84c
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 7
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
mov word [ebp - 0x5c], bx
call fcn.004023e0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 8
call fcn.00401070
mov edi, dword [ebp - 0x48]
lea ecx, [ebp - 0x60]
call fcn.004023d0
push eax
call fcn.005de123
add esp, 4
lea ecx, [ebp - 0x70]
mov ebx, eax
call fcn.004023d0
push eax
call fcn.005de123
add edi, ebx
lea ebx, [eax + edi + 3]
lea edi, [ebx + ebx]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x38], edx
je 0x413689
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x60]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x70]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x50]
call fcn.004023d0
push eax
mov eax, dword [ebp - 0x38]
push ebx
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 7
call fcn.00401070
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.00401070
mov edx, dword [ebp - 0x38]
mov eax, dword [esi + 0x48]
mov cl, byte [eax + 0x3b]
test cl, cl
jne 0x41377d
mov ecx, dword [0x6ec794]
test ecx, ecx
jne 0x41377d
mov cl, byte [eax + 0x25]
test cl, cl
je 0x41377d
mov eax, dword [ebp - 0x18]
mov ebx, 1
mov dword [esi + 0x4c], ebx
xor esi, esi
cmp eax, esi
jne 0x413913
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0xcc]
cmp edx, esi
rep stosd dword es:[edi], eax
mov dword [ebp - 0xcc], 0x3c
mov dword [ebp - 0xc8], 0x40
mov dword [ebp - 0xc0], 0x6bd840
jne 0x413720
lea edx, [ebp - 0x34]
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], 3
mov dword [ebp - 0xac], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xb8], 0x6bd828
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x413772
mov ecx, dword [ebp - 0x94]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x84], ebx
jmp 0x413913
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0xcc]
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp - 0xcc], 0x3c
cmp edx, edi
mov dword [ebp - 0xc8], 0x40
mov dword [ebp - 0xc0], 0x6bd840
jne 0x4137b3
lea edx, [ebp - 0x34]
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb0], 3
mov dword [ebp - 0xac], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x38]
cmp eax, edi
mov dword [ebp - 0xb8], 0x6bd814
jne 0x4137ef
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413913
mov eax, dword [ebp - 0x38]
cmp eax, edi
jne 0x413809
lea eax, [ebp - 0x34]
push edi
push eax
mov ecx, esi
call fcn.00412850
test al, al
je 0x413913
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0xcc]
push eax
call ebx
test eax, eax
je 0x41390d
mov ecx, dword [ebp - 0x94]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 1
push 0xffffffffffffffff
push ecx
mov dword [ebp - 0x14], edi
call esi
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x413865
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x18]
mov dword [0x6ec108], edi
test eax, eax
jne 0x413913
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0xcc]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xcc], 0x3c
test eax, eax
mov dword [ebp - 0xc8], 0x40
mov dword [ebp - 0xc0], 0x6bd840
je 0x4138b2
mov dword [ebp - 0xbc], eax
jmp 0x4138bb
lea edx, [ebp - 0x34]
mov dword [ebp - 0xbc], edx
xor eax, eax
mov dword [ebp - 0xb0], 3
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xac], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xb8], 0x6bd828
call ebx
test eax, eax
je 0x413901
mov ecx, dword [ebp - 0x94]
push 0xffffffffffffffff
push ecx
call esi
mov dword [ebp - 0x84], 1
jmp 0x413913
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x3c], 0
mov byte [ebp - 4], 0
call fcn.00401070
jmp 0x41393b
cmp edi, ebx
je 0x413955
mov edx, dword [ebp - 0x74]
lea ecx, [esi + 4]
push edx
call fcn.0040b860
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x413955
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x41395c
mov dword [0x6ec104], 1
jmp 0x41395c
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [0x6ec7a0]
xor eax, eax
push 4
test ecx, ecx
lea ecx, [ebp - 0x8c]
push ecx
push 4
push 0
push 0x6bcd9c
setne al
push edx
mov dword [ebp - 0x8c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x44]
xor ebx, ebx
cmp dword [ebp - 0x2c], ebx
je 0x4139b4
cmp dword [ebp - 0x3c], ebx
je 0x4139a3
mov ecx, esi
call fcn.00414510
jmp 0x4139af
cmp dword [ebp - 0x7c], ebx
jne 0x4139af
mov ecx, esi
call fcn.00414450
cmp dword [ebp - 0x2c], ebx
jne 0x413a07
lea eax, [ebp - 0x18]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x6bd7e4
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x413a07
mov ecx, dword [ebp - 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x6bd7d4
push ecx
call edi
mov edx, dword [ebp - 0x18]
push 0x6bd7cc
push edx
call edi
mov eax, dword [ebp - 0x18]
push 0x6bd7bc
push eax
call edi
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00418640
cmp dword [0x6ec104], ebx
je 0x413a5b
mov eax, dword [0x6ec7a0]
lea edx, [ebp - 0x20]
push 4
push edx
push 4
push ebx
push 0x6bd7b0
push eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [0x6ed428]
mov edx, dword [0x6ed3d4]
push 0x50030
push ecx
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.00411c40
add esp, 4
cmp dword [ebp - 0x2c], ebx
jne 0x413a65
cmp dword [ebp - 0x54], ebx
jne 0x413aac
mov edx, dword [0x6ec7a0]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28]
push eax
push ecx
push ebx
push ebx
push 0x6bd7b0
push edx
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413cd4
mov eax, dword [0x6ec7a0]
mov edi, dword [ebp - 0x28]
push 0x6bd7b0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test edi, edi
je 0x413cd4
mov ecx, dword [0x6ec7a0]
push 0x6bd7b0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [0x6ec7a0]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x74]
lea eax, [ebp - 0x1c]
xor esi, esi
push edx
push eax
push esi
push esi
push 0x6bd874
push ecx
xor ebx, ebx
mov dword [ebp - 0x74], 4
call edi
test eax, eax
jne 0x413aee
mov esi, dword [ebp - 0x1c]
mov ecx, dword [0x6ec7a0]
lea edx, [ebp - 0x74]
lea eax, [ebp - 0x1c]
push edx
push eax
push 0
push 0
push 0x6bd868
push ecx
mov dword [ebp - 0x74], 4
call edi
test eax, eax
jne 0x413b1d
mov eax, dword [ebp - 0x1c]
cmp eax, 1
mov ebx, eax
je 0x413b26
cmp esi, 1
jne 0x413cd4
lea ecx, [ebp - 0x14]
mov edi, 1
call fcn.004ee720
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x54]
push edx
push eax
push 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call fcn.004ef780
cmp ebx, edi
jne 0x413b55
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x413b55
xor edi, edi
cmp esi, 1
jne 0x413b60
cmp dword [ebp - 0x54], 0xffffffff
je 0x413b68
test edi, edi
jne 0x413c73
mov ecx, dword [0x6ed40c]
mov edx, dword [0x6ed3fc]
push 0x50030
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [ebp - 0x44]
lea ecx, [edi + 4]
call fcn.0040c7f0
mov ecx, dword [0x6ec7a0]
lea eax, [ebp - 0x18]
push 4
push eax
push 4
push 0
push 0x6bd8c4
push ecx
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x40]
mov dword [edi + 0x1c], 0
call fcn.004ee720
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x54]
push edx
push eax
push 0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xb
call fcn.004ef780
mov edi, 1
cmp ebx, edi
mov eax, edi
jne 0x413be9
cmp dword [ebp - 0x3c], 0xffffffff
jne 0x413be9
xor eax, eax
cmp esi, edi
jne 0x413bf3
cmp dword [ebp - 0x54], 0xffffffff
je 0x413bf7
test eax, eax
jne 0x413c62
mov edx, dword [0x6ec7a0]
lea ecx, [ebp - 0x18]
push 4
push ecx
push 4
push 0
push 0x6bd7a0
push edx
mov dword [ebp - 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x6ed40c]
mov ecx, dword [0x6ed3f8]
push 0x50030
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.00411c40
add esp, 4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xa
call fcn.004ee750
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004ee750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x80], edi
mov byte [ebp - 4], 0xa
call fcn.004ee750
jmp 0x413cc8
mov eax, dword [ebp - 0x54]
push 0x50000
cmp eax, 1
jne 0x413c8f
mov edx, dword [0x6ed40c]
mov eax, dword [0x6ed3cc]
push edx
push eax
jmp 0x413c9d
mov ecx, dword [0x6ed40c]
mov edx, dword [0x6ed3f4]
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x6ec7a0]
lea eax, [ebp - 0x18]
push 4
push eax
push 4
push 0
push 0x6bd8c4
push ecx
mov dword [ebp - 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004ee750
mov eax, dword [ebp - 0x80]
test eax, eax
jne 0x413d25
mov ecx, dword [0x6ec7a0]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x80]
push edx
push eax
push 0
push 0
push 0x6bd7a0
push ecx
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413dc8
mov edx, dword [0x6ec7a0]
mov edi, dword [ebp - 0x80]
push 0x6bd7a0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test edi, edi
je 0x413dc8
push 0
lea ecx, [ebp - 0x13c0]
call fcn.00519060
lea ecx, [ebp - 0x13c0]
mov byte [ebp - 4], 0xc
call fcn.005f6856
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 0x14
call fcn.005fa859
lea ecx, [ebp - 0x1230]
mov byte [ebp - 4], 0x13
call fcn.005a1de0
lea ecx, [ebp - 0x1238]
mov byte [ebp - 4], 0x12
call fcn.005fa859
lea ecx, [ebp - 0x1274]
mov byte [ebp - 4], 0x11
call fcn.006024ed
lea ecx, [ebp - 0x12b0]
mov byte [ebp - 4], 0x10
call fcn.006024ed
lea ecx, [ebp - 0x12ec]
mov byte [ebp - 4], 0xf
call fcn.006024ed
lea ecx, [ebp - 0x1328]
mov byte [ebp - 4], 0xe
call fcn.00602365
lea ecx, [ebp - 0x1364]
mov byte [ebp - 4], 0xd
call fcn.0060239d
lea ecx, [ebp - 0x13c0]
mov byte [ebp - 4], 0
call fcn.005f6497
mov ebx, dword [ebp - 0x44]
mov ecx, ebx
call fcn.004162f0
mov ecx, ebx
call fcn.00417fa0
mov ecx, ebx
call fcn.00414440
xor esi, esi
cmp eax, esi
jne 0x413e11
push esi
push esi
mov ecx, ebx
call fcn.00416b10
push esi
push esi
mov ecx, ebx
call fcn.00417690
push esi
push esi
mov ecx, ebx
call fcn.00417700
push esi
push esi
mov ecx, ebx
call fcn.00416d70
mov ecx, ebx
call fcn.00529380
cmp dword [ebx + 0x1c], esi
je 0x413e21
push 1
mov ecx, ebx
call fcn.0041f110
jmp 0x413e34
mov ecx, ebx
call fcn.00419ca0
cmp eax, esi
jne 0x413e34
push esi
mov ecx, ebx
call fcn.00419cf0
cmp dword [0x6ec794], esi
je 0x413e43
mov ecx, ebx
call fcn.0041f380
cmp dword [ebp - 0x2c], esi
je 0x414333
lea eax, [ebp - 0x88]
lea ecx, [ebp - 0x90]
lea edi, [ebx + 4]
push eax
push ecx
mov ecx, edi
call fcn.0040cd10
cmp eax, esi
je 0x4140a9
cmp dword [ebp - 0x7c], esi
jne 0x413e7d
mov ecx, edi
call fcn.0040c7f0
jmp 0x41433f
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], eax
mov word [ebp - 0x34], si
mov edi, dword [0x6ec738]
mov byte [ebp - 4], 0x15
cmp edi, esi
jne 0x413e9c
mov edi, 0x6ec73c
mov edx, 0x6bc11c
test edx, edx
je 0x413fd0
cmp edi, esi
je 0x413fd0
mov ecx, 0x6bd84c
test ecx, ecx
je 0x413fd0
push esi
push edx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], esi
mov word [ebp - 0x5c], si
call fcn.00402d00
push edi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x68], esi
mov word [ebp - 0x6c], si
call fcn.004023e0
push 0x6bd84c
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x48], esi
mov word [ebp - 0x4c], si
call fcn.004023e0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x18
call fcn.00401070
mov eax, dword [ebp - 0x70]
cmp eax, esi
jne 0x413f1a
lea eax, [ebp - 0x6c]
mov ebx, dword [ebp - 0x50]
cmp ebx, esi
jne 0x413f24
lea ebx, [ebp - 0x4c]
mov edi, dword [ebp - 0x58]
push eax
call fcn.005de123
mov edx, eax
push ebx
mov dword [ebp - 0x20], edx
call fcn.005de123
mov edx, dword [ebp - 0x20]
add edi, edx
lea ebx, [eax + edi + 3]
lea edi, [ebx + ebx]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 0xc
cmp edx, esi
mov dword [ebp - 0x38], edx
je 0x413fa6
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x50]
cmp eax, esi
mov edx, eax
jne 0x413f76
lea edx, [ebp - 0x4c]
mov ecx, dword [ebp - 0x70]
cmp ecx, esi
jne 0x413f80
lea ecx, [ebp - 0x6c]
mov eax, dword [ebp - 0x60]
cmp eax, esi
jne 0x413f8a
lea eax, [ebp - 0x5c]
push edx
push ecx
push eax
mov eax, dword [ebp - 0x38]
push ebx
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x17
call fcn.00401070
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x16
call fcn.00401070
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x15
call fcn.00401070
mov eax, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x44]
cmp eax, esi
jne 0x413fd7
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41409d
mov eax, dword [ebp - 0x38]
cmp eax, esi
jne 0x413ff1
lea eax, [ebp - 0x34]
push esi
push eax
mov ecx, ebx
call fcn.00412850
test al, al
je 0x41409d
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0xcc]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xcc], 0x3c
cmp eax, esi
mov dword [ebp - 0xc8], 0x40
mov dword [ebp - 0xc0], 0x6bd840
je 0x41403e
mov dword [ebp - 0xbc], eax
jmp 0x414047
lea edx, [ebp - 0x34]
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], 3
mov dword [ebp - 0xac], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xb8], 0x6bd828
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x414093
mov ecx, dword [ebp - 0x94]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x84], 1
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.00401070
cmp dword [ebp - 0x7c], esi
je 0x414333
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push 0x6bd794
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x4140d7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x414112
call fcn.00445c70
neg eax
sbb eax, eax
lea edx, [ebp - 0x20]
and eax, 0x100
push edx
add eax, 0x20019
push eax
push esi
push 0x6bd768
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x414333
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x50], eax
mov word [ebp - 0x4c], si
mov edi, dword [0x6ec738]
mov byte [ebp - 4], 0x19
cmp edi, esi
jne 0x414131
mov edi, 0x6ec73c
mov ecx, 0x6bc11c
test ecx, ecx
je 0x414262
cmp edi, esi
je 0x414262
mov edx, 0x6bd84c
test edx, edx
je 0x414262
push esi
push ecx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], esi
mov word [ebp - 0x5c], si
call fcn.00402d00
push edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov word [ebp - 0x34], si
call fcn.004023e0
push 0x6bd84c
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x68], esi
mov word [ebp - 0x6c], si
call fcn.004023e0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x1c
call fcn.00401070
mov eax, dword [ebp - 0x38]
cmp eax, esi
jne 0x4141af
lea eax, [ebp - 0x34]
mov ebx, dword [ebp - 0x70]
cmp ebx, esi
jne 0x4141b9
lea ebx, [ebp - 0x6c]
mov edi, dword [ebp - 0x58]
push eax
call fcn.005de123
mov edx, eax
push ebx
mov dword [ebp - 0x20], edx
call fcn.005de123
mov ecx, dword [ebp - 0x20]
add edi, ecx
lea ebx, [eax + edi + 3]
lea edi, [ebx + ebx]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 0xc
cmp edx, esi
mov dword [ebp - 0x50], edx
je 0x41423b
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x70]
cmp eax, esi
mov edx, eax
jne 0x41420b
lea edx, [ebp - 0x6c]
mov ecx, dword [ebp - 0x38]
cmp ecx, esi
jne 0x414215
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x60]
cmp eax, esi
jne 0x41421f
lea eax, [ebp - 0x5c]
push edx
push ecx
push eax
mov eax, dword [ebp - 0x50]
push ebx
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x1b
call fcn.00401070
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x1a
call fcn.00401070
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x19
call fcn.00401070
mov eax, dword [ebp - 0x50]
cmp eax, esi
jne 0x414269
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x414327
mov eax, dword [ebp - 0x50]
cmp eax, esi
jne 0x414283
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 0x44]
push 1
push eax
call fcn.00412850
test al, al
je 0x414327
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x108]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x108], 0x3c
cmp eax, esi
mov dword [ebp - 0x104], 0x40
mov dword [ebp - 0xfc], 0x6bd840
je 0x4142d2
mov dword [ebp - 0xf8], eax
jmp 0x4142db
lea edx, [ebp - 0x4c]
mov dword [ebp - 0xf8], edx
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0xec], 3
mov dword [ebp - 0xe8], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0xf4], 0x6bd750
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x414327
mov ecx, dword [ebp - 0xd0]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.00401070
cmp dword [ebp - 0x84], esi
je 0x413c51
mov edx, dword [0x6ed428]
mov eax, dword [0x6ed3d4]
push 0x50030
push edx
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.00411c40
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret