Function at 0x10004980
Capabilities:
Check os version
Delete registry key
Delete registry value
Persist via contextmenuhandlers registry key
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016f476
mov eax, dword fs:[0]
push eax
mov eax, 0x1798
call fcn.10062f00
mov eax, dword [0x101d9154]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1784], ecx
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x1f8]
mov ecx, 0x1e
mov dword [ebp - 0x1780], eax
mov eax, dword [ebp + 0xc]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x17a0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x178c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x179c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1788], eax
mov eax, dword [ebp + 0x28]
push 0x4e
mov dword [ebp - 0x1794], eax
lea eax, [ebp - 0x17e]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.10080190
push 0xc8
lea eax, [ebp - 0x3c8]
push 0
push eax
call fcn.10080190
push 0xc8
lea eax, [ebp - 0x300]
push 0
push eax
call fcn.10080190
push 0xc8
lea eax, [ebp - 0x490]
push 0
push eax
call fcn.10080190
push 0x190
lea eax, [ebp - 0x7b0]
push 0
push eax
call fcn.10080190
push 0x190
lea eax, [ebp - 0xe68]
push 0
push eax
call fcn.10080190
add esp, 0x48
lea eax, [ebp - 0x1638]
push 0x7d0
push 0
push eax
call fcn.10080190
push 0x190
lea eax, [ebp - 0x940]
push 0
push eax
call fcn.10080190
push 0x190
lea eax, [ebp - 0x620]
push 0
push eax
call fcn.10080190
push 0x190
lea eax, [ebp - 0xad0]
push 0
push eax
call fcn.10080190
push 0x100
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.10080190
mov esi, dword [ebp - 0x1780]
lea eax, [ebp - 0x130]
push esi
push dword [ebp - 0x17a0]
push 0x10173548
push eax
call fcn.10006d80
add esp, 0x4c
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x1f8]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x3ca], ax
test ax, ax
jne 0x10004af5
mov edx, esi
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004b10
lea edi, [ebp - 0x3c8]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004b26
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x3c8]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004b50
mov ecx, 8
mov esi, str.OpenWithProgids
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsw word es:[edi], word [esi]
nop dword [eax]
movzx eax, word [ebp + ecx - 0x1f8]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x302], ax
test ax, ax
jne 0x10004b70
mov edx, dword [ebp - 0x1780]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004b90
lea edi, [ebp - 0x300]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004ba6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x300]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10004bd0
mov eax, dword [str.UserChoice]
mov dword [ecx], eax
mov eax, dword [0x101736b4]
mov dword [ecx + 4], eax
mov eax, dword [0x101736b8]
mov dword [ecx + 8], eax
mov eax, dword [0x101736bc]
mov dword [ecx + 0xc], eax
mov eax, dword [0x101736c0]
mov dword [ecx + 0x10], eax
mov eax, dword [0x101736c4]
mov dword [ecx + 0x14], eax
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x1f8]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x492], ax
test ax, ax
jne 0x10004c10
mov edx, dword [ebp - 0x1780]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004c30
lea edi, [ebp - 0x490]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004c46
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x490]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004c70
mov edx, dword [ebp - 0x1780]
mov ecx, 7
mov esi, str.OpenWithList
rep movsd dword es:[edi], dword [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004c90
lea edi, [ebp - 0x1f8]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004ca6
mov eax, dword [ebp - 0x1784]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp dword [eax + 0x14], 8
rep movsb byte es:[edi], byte [esi]
jb 0x10004cd0
mov ecx, dword [eax]
jmp 0x10004cd2
mov ecx, eax
lea edx, [ebp - 0x7b0]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10004ce0
lea edi, [ebp - 0x7b0]
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004d00
mov ecx, 9
mov edx, dword [ebp - 0x1780]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004d22
lea edi, [ebp - 0x7b0]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004d40
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x7b0]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0xe6a], ax
test ax, ax
jne 0x10004d60
lea edi, [ebp - 0xe68]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004d81
mov eax, dword [ebp - 0x1784]
mov ecx, 8
mov esi, str.OpenWithProgids
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x14], 8
movsw word es:[edi], word [esi]
jb 0x10004dab
mov ecx, dword [eax]
jmp 0x10004dad
mov ecx, eax
lea edx, [ebp - 0x1638]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10004db3
lea edi, [ebp - 0x1638]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004dd0
mov ecx, 9
lea edx, [ebp - 0x130]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004df2
lea edi, [ebp - 0x1638]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004e10
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1638]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004e33
mov eax, dword [ebp - 0x1784]
mov ecx, 6
mov esi, str.DefaultIcon
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x14], 8
movsw word es:[edi], word [esi]
jb 0x10004e5d
mov ecx, dword [eax]
jmp 0x10004e5f
mov ecx, eax
lea edx, [ebp - 0x940]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10004e65
lea edi, [ebp - 0x940]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004e80
mov ecx, 9
lea edx, [ebp - 0x130]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004ea2
lea edi, [ebp - 0x940]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004ec0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x940]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004ee3
mov eax, dword [ebp - 0x1784]
mov ecx, 0xa
mov esi, str._shellopencommand
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x14], 8
jb 0x10004f0b
mov ecx, dword [eax]
jmp 0x10004f0d
mov ecx, eax
lea edx, [ebp - 0x620]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10004f13
lea edi, [ebp - 0x620]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004f30
mov ecx, 9
lea edx, [ebp - 0x130]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004f52
lea edi, [ebp - 0x620]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004f70
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x620]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004f93
mov eax, dword [ebp - 0x1784]
mov ecx, 0xf
mov esi, str._shellexContextMenuHandlers_
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x14], 8
jb 0x10004fbb
mov ecx, dword [eax]
jmp 0x10004fbd
mov ecx, eax
lea edx, [ebp - 0xad0]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10004fc3
lea edi, [ebp - 0xad0]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004fe0
mov ecx, 9
lea edx, [ebp - 0x130]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10005002
lea edi, [ebp - 0xad0]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005020
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xad0]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005043
mov ecx, 0xa
mov esi, str._shellexDropHandler
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp + 0x24], al
je 0x10005728
mov edx, dword [ebp - 0x1788]
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10005070
lea edi, [ebp - 0x620]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005086
mov ecx, edx
lea eax, [ebp - 0x130]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
lea eax, [ebp - 0x300]
and ecx, 3
push str.ProgId
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x1784]
mov ecx, esi
push eax
push reloc.WS2_32.dll_accept
call fcn.10003a70
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test al, al
je 0x1000520b
lea eax, [ebp - 0x17a4]
mov dword [ebp - 0x1790], 0
push eax
push 0
lea eax, [ebp - 0x1790]
mov dword [ebp - 0x17a4], 0
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x3c8]
push eax
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x1000520b
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
push 0x101744f4
lea eax, [ebp - 0x7b0]
push eax
push reloc.WS2_32.dll_closesocket
call fcn.10003a70
test al, al
je 0x1000520b
lea eax, [ebp - 0x1790]
mov dword [ebp - 0x17a4], 0
push eax
push 0
lea eax, [ebp - 0x17a4]
mov dword [ebp - 0x1790], 0
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xe68]
push eax
push reloc.WS2_32.dll_closesocket
call edi
test eax, eax
jne 0x1000520b
push dword [ebp - 0x179c]
lea eax, [ebp - 0x1638]
mov ecx, esi
push 0x101744f4
push eax
push reloc.WS2_32.dll_closesocket
call fcn.10003a70
test al, al
je 0x1000520b
push dword [ebp - 0x178c]
lea eax, [ebp - 0x940]
mov ecx, esi
push 0x101744f4
push eax
push reloc.WS2_32.dll_closesocket
call fcn.10003a70
test al, al
je 0x1000520b
push 0
push 0
lea eax, [ebp - 0x620]
mov ecx, esi
push eax
push reloc.WS2_32.dll_closesocket
call fcn.10003a30
test al, al
je 0x1000520b
push dword [ebp - 0x1788]
lea eax, [ebp - 0xad0]
mov ecx, esi
push 0x101744f4
push eax
push reloc.WS2_32.dll_closesocket
call fcn.10003a70
test al, al
je 0x1000520b
mov eax, dword [ebp - 0x1794]
mov byte [eax], 0
jmp 0x100058f9
mov eax, dword [ebp - 0x1794]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [eax], 1
lea eax, [ebp - 0x300]
push eax
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x3c8]
push eax
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x490]
push eax
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x1f8]
push eax
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x1f8]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp - 0x1784]
mov dword [ebp - 0x1798], 1
push eax
push 0
lea eax, [ebp - 0x1798]
mov dword [ebp - 0x1784], 0
push eax
push 0x101744f4
push dword [ebp - 0x1780]
push connect
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x100053c1
push dword [ebp - 0x1784]
call fcn.100833d6
push dword [ebp - 0x1784]
mov dword [ebp - 0x1794], eax
push 0
push eax
call fcn.10080190
add esp, 0x10
mov dword [ebp - 0x1798], 1
lea eax, [ebp - 0x1784]
push eax
mov eax, dword [ebp - 0x1794]
push eax
lea eax, [ebp - 0x1798]
push eax
push 0x101744f4
push dword [ebp - 0x1780]
push connect
call edi
mov edi, dword [ebp - 0x1794]
test edi, edi
je 0x100053c3
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005310
sub ecx, edx
sar ecx, 1
je 0x100053c3
lea ecx, [ebp - 0x130]
mov eax, edi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10005356
test dx, dx
je 0x10005352
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10005356
add eax, 4
add ecx, 4
test dx, dx
jne 0x10005330
xor eax, eax
jmp 0x1000535b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100053c3
push 0x208
lea eax, [ebp - 0xcd8]
push 0
push eax
call fcn.10080190
push dword [ebp - 0x17a0]
lea eax, [ebp - 0xcd8]
push str._sBackup
push eax
call fcn.10006d80
mov ecx, edi
add esp, 0x18
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005391
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
lea eax, [ebp - 0xcd8]
push eax
push dword [ebp - 0x1780]
push connect
call esi
jmp 0x100053c3
xor edi, edi
lea ecx, [ebp - 0x130]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100053d0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x130]
push eax
push 1
push 0x101744f4
lea eax, [ebp - 0x7b0]
push eax
push reloc.WS2_32.dll_closesocket
call esi
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xe68]
push eax
push reloc.WS2_32.dll_closesocket
call esi
mov ecx, dword [ebp - 0x179c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005427
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0x179c]
lea eax, [ebp - 0x1638]
push 1
push 0x101744f4
push eax
push reloc.WS2_32.dll_closesocket
call esi
mov ecx, dword [ebp - 0x178c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005462
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0x178c]
lea eax, [ebp - 0x940]
push 1
push 0x101744f4
push eax
push reloc.WS2_32.dll_closesocket
call esi
push 0
push 0
push 1
push 0
lea eax, [ebp - 0x620]
push eax
push reloc.WS2_32.dll_closesocket
call esi
mov ecx, dword [ebp - 0x1788]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100054b3
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0x1788]
lea eax, [ebp - 0xad0]
push 1
push 0x101744f4
push eax
push reloc.WS2_32.dll_closesocket
call esi
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x3c8]
push eax
push reloc.WS2_32.dll_accept
call esi
lea ecx, [ebp - 0x130]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005510
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x130]
push eax
push 1
push str.ProgId
lea eax, [ebp - 0x300]
push eax
push reloc.WS2_32.dll_accept
call esi
push 0x110
lea eax, [ebp - 0x1778]
push 0
push eax
call fcn.10080190
add esp, 0xc
mov dword [ebp - 0x177c], 0x114
lea eax, [ebp - 0x177c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1778], 6
jb 0x100056e5
cmp dword [ebp - 0x1774], 2
jb 0x100058ec
push 0x40
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x238]
movq qword [ebp - 0x1f], xmm0
push 0
push eax
movups xmmword [ebp - 0x2f], xmm0
mov dword [ebp - 0x17], 0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
call fcn.10080190
add esp, 0xc
call fcn.10004900
mov ecx, eax
call fcn.10014aa0
push eax
lea ecx, [ebp - 0x1668]
call fcn.10003560
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x1650], ax
lea ecx, [ebp - 0x1650]
lea eax, [ebp - 0x1668]
mov dword [ebp - 0x163c], 7
push eax
mov dword [ebp - 0x1640], 0
call fcn.10006710
push str.Assohash.dll
lea ecx, [ebp - 0x1650]
mov byte [ebp - 4], 1
call fcn.100039b0
cmp dword [ebp - 0x163c], 8
lea eax, [ebp - 0x1650]
cmovae eax, dword [ebp - 0x1650]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10005668
push str.HashAssociation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005668
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x130]
push ecx
push dword [ebp - 0x1780]
call eax
add esp, 0xc
lea ecx, [ebp - 0x30]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005670
sub ecx, edx
je 0x100056ca
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10003a00
lea ecx, [ebp - 0x130]
add esp, 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005697
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x238]
push eax
push 1
push str.Hash
lea eax, [ebp - 0x300]
push eax
push reloc.WS2_32.dll_accept
call esi
lea ecx, [ebp - 0x1650]
call fcn.10003860
lea ecx, [ebp - 0x1668]
call fcn.10003860
jmp 0x100058ec
lea ecx, [ebp - 0x130]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100056f0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x130]
push eax
push 1
push 0x101744f4
lea eax, [ebp - 0x1f8]
push eax
push reloc.WS2_32.dll_closesocket
call esi
jmp 0x100058ec
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x300]
push eax
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x3c8]
push eax
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x490]
push eax
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x1f8]
push eax
push reloc.WS2_32.dll_accept
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp - 0x1f8]
push eax
push reloc.WS2_32.dll_accept
call esi
lea eax, [ebp - 0x130]
push eax
push connect
call esi
push 0x208
lea eax, [ebp - 0xcd8]
mov dword [ebp - 0x178c], 1
push 0
push eax
mov dword [ebp - 0x1788], 0
call fcn.10080190
push dword [ebp - 0x17a0]
lea eax, [ebp - 0xcd8]
push str._sBackup
push eax
call fcn.10006d80
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x1788]
add esp, 0x18
push eax
push 0
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0xcd8]
push eax
push dword [ebp - 0x1780]
push connect
call esi
test eax, eax
jne 0x100058f9
push dword [ebp - 0x1788]
call fcn.100833d6
push dword [ebp - 0x1788]
mov edi, eax
push 0
push edi
call fcn.10080190
add esp, 0x10
mov dword [ebp - 0x178c], 1
lea eax, [ebp - 0x1788]
push eax
push edi
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0xcd8]
push eax
push dword [ebp - 0x1780]
push connect
call esi
test edi, edi
je 0x100058f9
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005853
sub ecx, edx
sar ecx, 1
je 0x100058ec
lea ecx, [ebp - 0x130]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10005896
test dx, dx
je 0x10005892
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10005896
add eax, 4
add ecx, 4
test dx, dx
jne 0x10005870
xor eax, eax
jmp 0x1000589b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100058d4
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100058a4
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0x101744f4
push dword [ebp - 0x1780]
push connect
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0xcd8]
push eax
push dword [ebp - 0x1780]
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test edi, edi
je 0x100058f9
push edi
call fcn.100833d1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10062ee4
mov esp, ebp
pop ebp
ret 0x24