Function at 0x404e30
Capabilities:
Create tcp socket
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword [0x409c20]
sub esp, 0x14
push ebx
push ebp
push esi
xor esi, esi
cmp eax, esi
mov eax, dword [esp + 0x24]
push edi
jne 0x404e4b
mov dword [0x409c20], eax
cmp dword [0x409d20], esi
jne 0x404e7e
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0xcf0000
push str.GlobalSinforSuperExe
push str.GlobalSinforSuperExe
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, esi
mov dword [0x409d20], eax
je 0x4051e7
mov eax, dword [0x408878]
cmp eax, 1
jne 0x404f17
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
mov ebx, 0x4e20
push str.SOFTWARESinforSSLPromote
push reloc.WS2_32.dll_bind
mov dword [0x408870], ebx
mov dword [esp + 0x4c], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x4051e7
mov edi, dword [esp + 0x28]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x14]
push 0x408870
push eax
push esi
push str.SuperExePort
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x40], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404f99
mov eax, dword [0x408870]
cmp eax, ebx
jl 0x404f99
cmp eax, 0x7530
jl 0x404f9f
jmp 0x404f99
cmp eax, esi
jne 0x4051e7
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push 0xf003f
push esi
push esi
push esi
mov ebx, 0x7530
push str.SOFTWARESinforSSLPromote
push reloc.WS2_32.dll_accept
mov dword [0x408870], ebx
mov dword [esp + 0x4c], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x4051e7
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
push 0x408870
push ecx
push esi
push str.SuperExeUserPort
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x40], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404f99
mov eax, dword [0x408870]
cmp eax, ebx
jl 0x404f99
cmp eax, 0x9c40
jl 0x404f9f
mov dword [0x408870], ebx
mov eax, dword [0x409c1c]
cmp eax, 0xffffffff
je 0x404fba
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x409c1c], 0xffffffff
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x409c1c], eax
jne 0x404fe9
cmp edi, esi
je 0x4051e7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov ax, word [0x408870]
mov ebx, dword [sym.imp.WS2_32.dll_htons]
xor edx, edx
push eax
mov dword [esp + 0x18], edx
mov word [esp + 0x18], 2
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
call ebx
push esi
mov word [esp + 0x1a], ax
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov edx, dword [0x409c1c]
mov ebp, dword [sym.imp.WS2_32.dll_bind]
add esp, 8
lea ecx, [esp + 0x14]
push 0x10
push ecx
push edx
call ebp
cmp eax, 0xffffffff
jne 0x4050d8
cmp esi, 3
jge 0x4050a9
inc esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2726
je 0x405064
cmp eax, 0x2740
jne 0x4050b2
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, eax
and ecx, 0x800000ff
jns 0x40507c
dec ecx
or ecx, 0xffffff00
inc ecx
mov eax, dword [0x408870]
add eax, ecx
push eax
mov dword [0x408870], eax
call ebx
mov word [esp + 0x16], ax
mov eax, dword [0x409c1c]
lea edx, [esp + 0x14]
push 0x10
push edx
push eax
call ebp
cmp eax, 0xffffffff
je 0x40504a
cmp esi, 3
jl 0x4050d8
mov edx, dword [0x409c1c]
push edx
jmp 0x4050b9
mov ecx, dword [0x409c1c]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
test edi, edi
je 0x4051e7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov eax, dword [0x408878]
cmp eax, 1
jne 0x4050fd
mov eax, dword [0x408870]
lea ecx, [esp + 0x28]
push 4
push ecx
push 4
push 0
mov dword [esp + 0x38], eax
push str.SuperExePort
jmp 0x40511f
test eax, eax
jne 0x4051dc
mov edx, dword [0x408870]
lea eax, [esp + 0x28]
push 4
push eax
push 4
push 0
mov dword [esp + 0x38], edx
push str.SuperExeUserPort
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4050bf
mov ecx, dword [0x409d20]
mov edx, dword [0x409c1c]
push 0x28
push 0x465
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
je 0x4050bf
mov eax, dword [0x409c1c]
push 3
push eax
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x4050bf
mov eax, dword [0x408878]
test eax, eax
jne 0x405186
test edi, edi
je 0x405179
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
mov eax, dword [0x409cf0]
mov esi, dword [sym.imp.KERNEL32.dll_OpenEventA]
test eax, eax
jne 0x4051b0
push str.GlobalSinforExeStartEvent
push 1
push 0x1f0003
call esi
test eax, eax
mov dword [0x409cf0], eax
je 0x4050bf
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x409cec]
test eax, eax
jne 0x40516e
push str.GlobalSinforServiceStartEvent
push 1
push 0x1f0003
call esi
test eax, eax
mov dword [0x409cec], eax
jne 0x40516e
jmp 0x4050bf
test edi, edi
je 0x4051e7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret