Function at 0x434e60
Capabilities:
Create thread
Enumerate network shares
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, ecx
mov dword [esp + 8], 0
push esi
push edi
xor edi, edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], edi
cmp dword [ebx + 0xc], edi
je 0x43519f
cmp dword [ebx + 0xe8], edi
jne 0x43519f
lea eax, [esp + 0x14]
push eax
push str.SOFTWARENational_InstrumentsNI_ZeroconfServicesSMB
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x434ef5
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 4
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push edi
push str.Advertise
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x18], edi
je 0x434f77
lea ecx, [esp + 0x20]
call fcn.00435720
test eax, eax
je 0x434f42
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
push 1
push 0
call dword [sym.imp.NETAPI32.dll_NetShareEnum]
test eax, eax
je 0x434fc8
cmp eax, 0xea
je 0x434fc8
cmp eax, 0x842
je 0x434f48
cmp dword [esp + 0x20], edi
je 0x434f77
mov ecx, dword [ebx]
push 0
push ebx
push 0x434c60
imul eax, dword [ecx + 8], 0xff676980
push 0
cdq
mov dword [esp + 0x40], eax
mov eax, edx
sar eax, 0x1f
lea eax, [esp + 0x40]
mov dword [esp + 0x44], edx
push eax
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov eax, dword [ebx]
mov eax, dword [eax + 0x58]
test eax, eax
jne 0x435173
test edi, edi
je 0x43516f
cmp dword [0x44f4dc], eax
jne 0x435158
mov eax, dword [0x44f4d0]
test eax, eax
jne 0x43503c
push str.dnssd.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x44f4d0], eax
test eax, eax
jne 0x43503c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435190
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov esi, eax
test ebx, ebx
je 0x435024
cmp dword [esi + 4], 0
jne 0x435018
mov eax, dword [esi]
mov ecx, str.print_
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x435009
test dx, dx
je 0x435005
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x435009
add eax, 4
add ecx, 4
test dx, dx
jne 0x434fe3
xor eax, eax
jmp 0x43500e
sbb eax, eax
or eax, 1
test eax, eax
mov eax, 1
cmovne edi, eax
add esi, 0xc
sub ebx, 1
jne 0x434fd6
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x10], 0
jmp 0x434f77
cmp dword [0x44f4b4], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x43506c
push str.DNSServiceRegister
push eax
call esi
mov dword [0x44f4b4], eax
test eax, eax
jne 0x435067
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435190
mov eax, dword [0x44f4d0]
cmp dword [0x44f4d8], 0
jne 0x435091
push str.DNSServiceRefDeallocate
push eax
call esi
mov dword [0x44f4d8], eax
test eax, eax
jne 0x435091
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435190
cmp dword [0x44f4a8], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
jne 0x4350be
push 0
push 0
push 0
push 0
call esi
mov dword [0x44f4a8], eax
test eax, eax
jne 0x4350be
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435190
cmp dword [0x44f4bc], 0
jne 0x4350e5
push 0
push 0
push 0
push 0
call esi
mov dword [0x44f4bc], eax
test eax, eax
jne 0x4350e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435190
cmp dword [0x44f4c8], 0
jne 0x43510c
push 0
push 0
push 0
push 0
call esi
mov dword [0x44f4c8], eax
test eax, eax
jne 0x43510c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435190
cmp dword [0x44f4c0], 0
jne 0x435130
push 0
push 0
push 0
push 0
call esi
mov dword [0x44f4c0], eax
test eax, eax
jne 0x435130
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435190
push 0
push 0
push ebx
push 0x434c70
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [0x44f4dc], eax
test eax, eax
jne 0x435158
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435190
push dword [0x44f4a8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx]
mov dword [eax + 0x58], 1
jmp 0x435190
test eax, eax
je 0x435190
test edi, edi
jne 0x435190
mov eax, dword [0x44f4bc]
test eax, eax
je 0x435187
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx]
mov dword [eax + 0x58], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43519f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret