Function at 0x412b40
Capabilities:
Contain obfuscated stackstrings
Delete file
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x4b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
call fcn.00403a70
mov ecx, eax
test ecx, ecx
je 0x413d99
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
mov byte [ebp - 0x11], 0
xor bl, bl
mov byte [ebp - 0x12], bl
lea ecx, [ebp - 0x28]
call fcn.00402820
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00402820
mov byte [ebp - 4], 4
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesCVirtADisplayName
lea ecx, [ebp - 0x30]
call fcn.0045d100
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 6
push ecx
mov dword [ebp - 0x5c], esp
mov dword [ebp - 0x48], esp
mov esi, dword [ebp - 0x30]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x412c02
cmp ecx, dword [esi - 0x10]
jne 0x412c02
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x412c2c
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413da3
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.00462eb0
add esp, 8
mov edx, 0x48780e
lea ecx, [ebp - 0x28]
call fcn.0045c400
test al, al
je 0x412ccc
mov bl, 1
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.net_stop_vpnagent
call fcn.0045d100
mov byte [ebp - 4], 9
mov byte [ebp - 4], 5
mov dl, bl
lea ecx, [ebp - 0x34]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x34]
call fcn.0045cbc0
push ecx
push str.the_service_name_is_invalid
lea ecx, [ebp - 0x34]
call fcn.0045cc50
test eax, eax
setns bl
mov byte [ebp - 0x12], bl
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412ccf
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x412ccf
or esi, 0xffffffff
mov edx, 0x48780e
lea ecx, [ebp - 0x28]
call fcn.0045c510
test al, al
jne 0x4139f9
cmp bl, 1
je 0x4139f9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.stemp.vbs
call fcn.0045c170
mov byte [ebp - 4], 0x17
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5c], esp
push 0x487a74
call fcn.0045c170
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 5
mov edx, 0x86
lea ecx, [ebp - 0x4c]
call fcn.00401370
add esp, 0x30
mov byte [ebp - 4], 0x19
push 0x4878c0
lea ecx, [ebp - 0x38]
call fcn.0045d100
mov byte [ebp - 4], 0x1a
push str.cscript___NOLOGO
lea ecx, [ebp - 0x34]
call fcn.0045d100
mov byte [ebp - 4], 0x1b
mov bl, 1
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x50]
call fcn.0045c7c0
mov byte [ebp - 4], 0x1c
mov ecx, esp
mov dword [ebp - 0x60], esp
lea edi, [ebp - 0x38]
push edi
mov edx, eax
call fcn.0045c7c0
add esp, 4
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1c
mov dl, bl
lea ecx, [ebp - 0x1c]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412db2
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412dd4
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412df6
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov dword [ebp - 0x60], esp
mov ebx, esp
mov dword [ebp - 0x5c], ebx
mov esi, dword [ebp - 0x1c]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x412e21
cmp ecx, dword [esi - 0x10]
jne 0x412e21
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x412e4b
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413da8
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov dword [ebx], eax
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x26
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.unableToConnectCiscoVPN_KB_11311_machine_details
call fcn.0045d100
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x23
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
mov edi, dword [ebp - 0x1c]
mov ebx, edi
mov dword [ebp - 0x54], ebx
xor esi, esi
mov dword [ebp - 0x3c], esi
mov ecx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
movzx eax, word [ebx]
test ax, ax
je 0x412ec4
push eax
call ecx
add esp, 4
test eax, eax
je 0x412eb4
test esi, esi
jne 0x412eb9
mov esi, ebx
mov dword [ebp - 0x3c], esi
add ebx, 2
mov dword [ebp - 0x54], ebx
mov edi, dword [ebp - 0x1c]
jmp 0x412e88
xor esi, esi
mov dword [ebp - 0x3c], esi
add ebx, 2
mov dword [ebp - 0x54], ebx
mov edi, dword [ebp - 0x1c]
jmp 0x412e88
test esi, esi
je 0x412f11
sub esi, edi
sar esi, 1
js 0x413dad
mov ebx, 1
mov ecx, ebx
sub ecx, dword [edi - 4]
mov eax, dword [edi - 8]
sub eax, esi
or eax, ecx
jge 0x412ef1
push esi
lea ecx, [ebp - 0x1c]
call fcn.004032b0
mov edi, dword [ebp - 0x1c]
cmp esi, dword [edi - 8]
jg 0x413dad
mov dword [edi - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov word [eax + esi*2], cx
mov edi, dword [ebp - 0x1c]
mov ecx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
jmp 0x412f16
mov ebx, 1
mov dword [ebp - 0x40], edi
nop dword [eax]
movzx eax, word [edi]
push eax
call ecx
add esp, 4
test eax, eax
je 0x412f3b
add edi, 2
mov dword [ebp - 0x40], edi
mov ecx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
jmp 0x412f20
mov eax, dword [ebp - 0x1c]
cmp edi, eax
je 0x412fb5
sub edi, eax
sar edi, 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
js 0x413db7
mov esi, ebx
sub esi, dword [eax - 4]
mov edx, dword [eax - 8]
sub edx, ecx
or edx, esi
jge 0x412f6b
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004032b0
mov eax, dword [ebp - 0x1c]
lea esi, [eax + edi*2]
mov dword [ebp - 0x40], esi
mov edx, dword [eax - 0xc]
mov ebx, edx
sub ebx, edi
lea ecx, [ebx*2 + 2]
push ecx
push esi
lea ecx, [edx*2 + 2]
push ecx
push eax
call fcn.0045d860
add esp, 0x10
test ebx, ebx
js 0x413dad
mov eax, dword [ebp - 0x1c]
cmp ebx, dword [eax - 8]
jg 0x413dad
mov dword [eax - 0xc], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov word [eax + ebx*2], cx
mov eax, dword [ebp - 0x1c]
push ecx
mov dword [ebp - 0x60], esp
mov ebx, esp
mov dword [ebp - 0x5c], ebx
lea esi, [eax - 0x10]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi + 0xc]
cmp dword [eax], 0
jl 0x412fdd
cmp ecx, dword [esi]
jne 0x412fdd
mov edi, esi
lock inc dword [eax]
jmp 0x41300a
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413dc1
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov edx, dword [esi + 4]
inc edx
push edx
lea eax, [esi + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov dword [ebx], eax
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 0x29
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.unableToConnectCiscoVPN_KB_11311_user_name
call fcn.0045d100
mov byte [ebp - 4], 0x2a
mov byte [ebp - 4], 0x23
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
push 0x48a0c8
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
push str.AppDataRoamingMicrosoftNetworkConnectionsPbk_rasphone.pbk
lea ecx, [ebp - 0x48]
call fcn.0045d100
mov byte [ebp - 4], 0x2b
push 0x48a188
lea ecx, [ebp - 0x44]
call fcn.0045d100
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.0045c7c0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x48]
push ecx
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.0045c7c0
add esp, 8
mov byte [ebp - 4], 0x2e
push dword [eax]
call esi
mov byte [ebp - 4], 0x2f
mov byte [ebp - 4], 0x2d
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4130ba
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x2c
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4130dc
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x31
mov byte [ebp - 4], 0x2b
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4130fe
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x32
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413120
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push str.AppDataRoamingMicrosoftNetworkConnectionsPbk_rasphone.pbk
lea ecx, [ebp - 0x44]
call fcn.0045d100
mov byte [ebp - 4], 0x33
push 0x48a188
lea ecx, [ebp - 0x48]
call fcn.0045d100
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x5c]
call fcn.0045c7c0
mov byte [ebp - 4], 0x35
mov ecx, esp
mov dword [ebp - 0x60], esp
lea edx, [ebp - 0x44]
push edx
mov edx, eax
call fcn.0045c7c0
add esp, 4
mov byte [ebp - 4], 0x36
mov byte [ebp - 4], 0x35
call fcn.00464350
add esp, 4
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41319a
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x38
mov byte [ebp - 4], 0x33
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4131bc
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4131de
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.C:ProgramDataMicrosoftNetworkConnectionsPbk_rasphone.pbk
call fcn.0045d100
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x23
call fcn.00464350
add esp, 4
test al, al
je 0x413336
push str.Failed_to_delete_VPN_connection
lea ecx, [ebp - 0x20]
call fcn.0045cef0
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0x3b
push ecx
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x5c], esp
mov esi, dword [ebp - 0x20]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413250
cmp ecx, dword [esi - 0x10]
jne 0x413250
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x41327a
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413dc6
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov byte [ebp - 4], 0x3c
mov byte [ebp - 4], 0x3d
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.Failure
call fcn.0045d100
mov byte [ebp - 4], 0x3e
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x24]
call fcn.0045fd10
add esp, 8
mov dword [ebp - 0x60], esp
mov dword [ebp - 0x5c], esp
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x4132d5
cmp ecx, dword [esi - 0x10]
jne 0x4132d5
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x4132ff
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413dcb
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov byte [ebp - 4], 0x3f
mov byte [ebp - 4], 0x40
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.unableToConnectCiscoVPN_KB_11311
call fcn.0045d100
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x23
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
mov byte [ebp - 0x11], 1
mov byte [ebp - 0x13], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.sc_config_vpnagent_startauto
call fcn.0045d100
mov byte [ebp - 4], 0x42
mov byte [ebp - 4], 0x23
mov dl, byte [ebp - 0x13]
lea ecx, [ebp - 0x44]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0x43
mov ecx, dword [eax]
mov dword [ebp - 0x48], ecx
mov edi, dword [ecx - 0xc]
mov edx, ecx
mov eax, dword [ebp - 0x18]
sub edx, eax
sar edx, 1
mov dword [ebp - 0x58], edx
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x5c], esi
test edi, edi
js 0x413dd0
test ecx, ecx
jne 0x41338e
xor edi, edi
jmp 0x41339e
push edi
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ecx, 0x7fffffff
sub ecx, edi
cmp ecx, esi
jl 0x413dda
add esi, edi
js 0x413de4
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, edx
jge 0x4133d2
push esi
lea ecx, [ebp - 0x18]
call fcn.004032b0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x4133e2
mov ecx, dword [ebp - 0x48]
push edi
push ecx
lea ecx, [eax + edx*2]
mov edx, edi
call fcn.004031c0
add esp, 8
mov eax, dword [ebp - 0x18]
cmp esi, dword [eax - 8]
jg 0x413dad
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov word [eax + esi*2], cx
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41342b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 0x13], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.net_start_vpnagent
call fcn.0045d100
mov byte [ebp - 4], 0x45
mov byte [ebp - 4], 0x23
mov dl, byte [ebp - 0x13]
lea ecx, [ebp - 0x60]
call fcn.00460ee0
add esp, 4
mov byte [ebp - 4], 0x46
mov ecx, dword [eax]
mov dword [ebp - 0x44], ecx
mov esi, dword [ecx - 0xc]
mov edx, ecx
mov eax, dword [ebp - 0x18]
sub edx, eax
sar edx, 1
mov dword [ebp - 0x58], edx
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x48], edx
test esi, esi
js 0x413dee
test ecx, ecx
jne 0x413483
xor edi, edi
jmp 0x413496
push esi
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
mov edi, eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x48]
mov ecx, 0x7fffffff
sub ecx, edi
cmp ecx, edx
jl 0x413df8
lea esi, [edx + edi]
test esi, esi
js 0x413e02
mov ecx, 1
sub ecx, dword [eax - 4]
mov dword [ebp - 0x5c], ecx
mov ecx, dword [eax - 8]
sub ecx, esi
or ecx, dword [ebp - 0x5c]
jge 0x4134d4
push esi
lea ecx, [ebp - 0x18]
call fcn.004032b0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x58]
cmp ecx, edx
lea ecx, [eax + ecx*2]
jbe 0x4134e1
mov ecx, dword [ebp - 0x44]
push edi
push ecx
lea ecx, [eax + edx*2]
mov edx, edi
call fcn.004031c0
add esp, 8
mov eax, dword [ebp - 0x18]
cmp esi, dword [eax - 8]
jg 0x413dad
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov word [eax + esi*2], cx
mov byte [ebp - 4], 0x47
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41352a
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push ecx
push str.successfully
lea ecx, [ebp - 0x18]
call fcn.0045cc50
test eax, eax
jle 0x413552
push ecx
push str.denied
lea ecx, [ebp - 0x18]
call fcn.0045cc50
test eax, eax
js 0x413682
push str.Failed_to_chnage_the_service_start_up_type
lea ecx, [ebp - 0x20]
call fcn.0045cef0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0x48
push ecx
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x60], esp
mov esi, dword [ebp - 0x20]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x41359c
cmp ecx, dword [esi - 0x10]
jne 0x41359c
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x4135c6
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413e0c
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x49
mov byte [ebp - 4], 0x4a
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.Failure
call fcn.0045d100
mov byte [ebp - 4], 0x4b
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x24]
call fcn.0045fd10
add esp, 8
mov dword [ebp - 0x5c], esp
mov dword [ebp - 0x60], esp
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413621
cmp ecx, dword [esi - 0x10]
jne 0x413621
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x41364b
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413e11
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x4c
mov byte [ebp - 4], 0x4d
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.unableToConnectCiscoVPN_KB_11311
call fcn.0045d100
mov byte [ebp - 4], 0x4e
mov byte [ebp - 4], 0x23
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
mov byte [ebp - 0x11], 1
lea ecx, [ebp - 0x2c]
call fcn.00402820
mov byte [ebp - 4], 0x4f
push ecx
push 0x48a254
lea ecx, [ebp - 0x28]
call fcn.0045cc50
lea ecx, [ebp - 0x2c]
test eax, eax
js 0x4136aa
push str.Cisco_Systems_VPN_Adapter_for_64_bit_Windows
jmp 0x4136af
push str.Cisco_Systems_VPN_Adapter
call fcn.0045d070
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.STRING
call fcn.0045d100
mov byte [ebp - 4], 0x50
push ecx
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x60], esp
mov esi, dword [ebp - 0x2c]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x4136f1
cmp ecx, dword [esi - 0x10]
jne 0x4136f1
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x41371b
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413e16
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x51
mov byte [ebp - 4], 0x52
push ecx
mov dword [ebp - 0x50], esp
mov dword [ebp - 0x60], esp
mov esi, dword [ebp - 0x30]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413754
cmp ecx, dword [esi - 0x10]
jne 0x413754
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x41377e
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413e1b
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x53
mov byte [ebp - 4], 0x54
mov byte [ebp - 4], 0x4f
call fcn.00461fe0
add esp, 0xc
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x4138d0
push str.Failed_to_update_the_registry_DisplayName
lea ecx, [ebp - 0x20]
call fcn.0045d070
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0x55
push ecx
mov dword [ebp - 0x50], esp
mov dword [ebp - 0x60], esp
mov esi, dword [ebp - 0x20]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x4137ef
cmp ecx, dword [esi - 0x10]
jne 0x4137ef
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x413819
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413e20
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x56
mov byte [ebp - 4], 0x57
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.Failure
call fcn.0045d100
mov byte [ebp - 4], 0x58
mov byte [ebp - 4], 0x4f
mov ecx, dword [ebp - 0x24]
call fcn.0045fd10
add esp, 8
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x60], esp
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 4]
cmp dword [eax], 0
jl 0x413871
cmp ecx, dword [esi - 0x10]
jne 0x413871
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x41389b
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x413e25
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
lea ecx, [edi + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x59
mov byte [ebp - 4], 0x5a
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.unableToConnectCiscoVPN_KB_11311
call fcn.0045d100
mov byte [ebp - 4], 0x5b
mov byte [ebp - 4], 0x4f
mov ecx, dword [ebp - 0x5c]
call fcn.0045f800
add esp, 8
jmp 0x413921
cmp byte [ebp - 0x11], 0
jne 0x413921
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0x5c
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.Necessary_changes_have_been_done.
call fcn.0045d100
mov byte [ebp - 4], 0x5d
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push str.Success
call fcn.0045d100
mov byte [ebp - 4], 0x5e
mov byte [ebp - 4], 0x4f
mov ecx, dword [ebp - 0x24]
call fcn.0045fd10
add esp, 0xc
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413943
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x60
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413965
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x61
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x4c]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413987
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x62
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4139a9
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x63
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4139cb
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x64
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4139ed
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 1
jmp 0x413c90
push str.Please_contact_IT_Support_for_your_problem.
lea ecx, [ebp - 0x20]
call fcn.0045d070
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push 0x48780e
call fcn.0045d100
mov byte [ebp - 4], 0xc
push ecx
mov dword [ebp - 0x58], esp
mov dword [ebp - 0x60], esp
mov edi, dword [ebp - 0x20]
add edi, 0xfffffff0
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [edi + 0xc]
cmp dword [eax], 0
jl 0x413a43
cmp ecx, dword [edi]
jne 0x413a43
mov ebx, edi
lock inc dword [eax]
jmp 0x413a70
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x413e2a
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov edx, dword [edi + 4]
inc edx
push edx
lea eax, [edi + 0x10]
push eax
lea ecx, [ebx + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.Cisco_VPN_is_not_installed.
call fcn.0045d100
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x24]
call fcn.0045fd10
add esp, 8
mov dword [ebp - 0x5c], esp
mov dword [ebp - 0x60], esp
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [edi + 0xc]
cmp dword [eax], 0
jl 0x413ac5
cmp ecx, dword [edi]
jne 0x413ac5
mov ebx, edi
lock inc dword [eax]
jmp 0x413af2
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x413e2f
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov edx, dword [edi + 4]
inc edx
push edx
lea eax, [edi + 0x10]
push eax
lea ecx, [ebx + 0x10]
call fcn.004031c0
add esp, 8
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.unableToConnectCiscoVPN_KB_11311
call fcn.0045d100
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 5
or ecx, 0xffffffff
call fcn.0045f800
add esp, 8
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413b47
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413b69
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413b8b
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [ebp - 4], 0x16
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x413caf
mov ecx, dword [edi]
push edi
jmp 0x413caa
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x413caf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403850
call fcn.004031b0
call fcn.004031b0
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
push 0x80070057
call fcn.00403850
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
call fcn.004031b0
int3