Function at 0x8ffb20
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb151c0
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1580
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ecx, 0x21e
mov esi, str.REGISTRYMACHINESOFTWAREMicroWorld_REGISTRYMACHINESOFTWAREClasseseScan.Net_REGISTRYMACHINESOFTWAREClassesEutAppList_REGISTRYMACHINESOFTWAREClassesEutAllowList_REGISTRYMACHINESOFTWAREClassesEutRegList__REGISTRYMACHINESOFTWAREClassesAppId06622D85_6856_4460_8DE1_A81921B41C4B_REGISTRYMACHINESOFTWAREClassesCLSID42aedc87_2188_41fd_b9a3_0c966feabec1_REGISTRYMACHINESOFTWAREClassesCLSIDF3130CDB_AA52_4C3A_AB32_85FFC23AF9C1_REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify__REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWindows__REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost__REGISTRYCCSTControlSecurityProviders__REGISTRYCCSTControlSafeBoot__REGISTRYCCSTControlLsaExtensionConfigLsaSrv__REGISTRYCCSTControlSession_ManagerSubSystems__REGISTRYCCSTControlBootVerificationProgram__REGISTRYCCSTServiceseconceal__REGISTRYCCSTServices_avdiskCDKey__REGISTRYCCSTServices_avdiskUSBKey_REGISTRYCCSTServices_bdfsfltr_REGISTRYCCSTServiceseconservice_REGISTRYCCSTServiceseScan_Monitor_Service_REGISTRYCCSTServiceseScan_trayicos_REGISTRYCCSTServiceseScan_trayicoc_REGISTRYCCSTServicesmwagent_REGISTRYCCSTServicesWinSock2_REGISTRYCCSTServicesWinSock__REGISTRYMACHINESYSTEMWPA_REGISTRYMACHINESYSTEMSelect_REGISTRYCCSTServices_avc3_REGISTRYCCSTServices_avchv_REGISTRYCCSTServices_avckf_REGISTRYCCSTServicesProcObsrv_REGISTRYCCSTServicesProcObsrves_REGISTRYCCSTServicesProcObsrvesx_REGISTRYMACHINESOFTWAREAVC3_REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_REGISTRYMACHINESOFTWAREMicrosoftInternet_ExplorerToolbar_REGISTRYMACHINESOFTWAREMicrosoftInternet_ExplorerExtensions_REGISTRYMACHINESOFTWAREMicrosoftInternet_ExplorerURLSearchHooks_REGISTRYMACHINESOFTWAREMicrosoftInternet_ExplorerExplorer_Bars__REGISTRYCCSTControlTimeZoneInformation__REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
lea edi, [ebp - 0x1538]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x185
xor ebx, ebx
push ebx
lea eax, [ebp - 0xcbd]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x1548], ebx
mov dword [ebp - 0x1564], ebx
mov dword [ebp - 0x1560], ebx
mov dword [ebp - 0x1570], ebx
mov dword [ebp - 4], ebx
push 0x80000002
lea eax, [ebp - 0x1548]
mov esi, 1
mov ecx, esi
mov edx, str.SOFTWAREClasseseScan.NET
call fcn.0097f000
add esp, 4
cmp eax, ebx
je 0x8ffbe1
lea ecx, [ebp - 0x1548]
push ecx
push str.SOFTWAREClasseseScan.NET
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [ebp - 0x1548]
cmp eax, ebx
je 0x8ffbf8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1548], ebx
xor ecx, ecx
lea eax, [ebp - 0x1568]
mov edx, str.ProtectWinsockEx
call fcn.008aed20
mov ecx, esi
lea eax, [ebp - 0x1594]
mov edx, str.ProtectAppId
call fcn.008aed20
mov ecx, esi
lea eax, [ebp - 0x1580]
mov edx, str.ProtectCLSID
call fcn.008aed20
mov ecx, esi
lea eax, [ebp - 0x1588]
mov edx, str.ProtectEScanServices
call fcn.008aed20
mov ecx, esi
lea eax, [ebp - 0x158c]
mov edx, str.ProtectIFEO
call fcn.008aed20
mov ecx, esi
lea eax, [ebp - 0x1578]
mov edx, str.ProtectWinlogon
call fcn.008aed20
mov ecx, esi
lea eax, [ebp - 0x1590]
mov edx, str.ProtectWindows
call fcn.008aed20
mov ecx, esi
lea eax, [ebp - 0x155c]
mov edx, str.ProtectSvcHost
call fcn.008aed20
mov ecx, esi
lea eax, [ebp - 0x1598]
mov edx, str.ProtectEConceal
call fcn.008aed20
mov ecx, esi
lea eax, [ebp - 0x157c]
mov edx, str.ProtectControl
call fcn.008aed20
mov ecx, esi
lea eax, [ebp - 0x1584]
mov edx, str.ProtectSYSTEM
call fcn.008aed20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push eax
push ebx
push 0x2000702
call dword [0xb8dac4]
mov byte [ebp - 0x224], bl
push 0x207
push ebx
lea edx, [ebp - 0x223]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x634], bl
push 0x207
push ebx
lea eax, [ebp - 0x633]
push eax
call fcn.00a7ffb0
add esp, 0x28
mov dword [ebp - 0x1558], ebx
mov dword [ebp - 0x1574], ebx
mov dword [ebp - 0x156c], ebx
call fcn.00968d70
test eax, eax
je 0x8ffd26
mov dword [ebp - 0x1574], esi
mov ecx, dword [0xb56800]
mov dword [ebp - 0x1540], ecx
call fcn.00968bc0
test eax, eax
je 0x8ffd41
mov dword [ebp - 0x1564], esi
call fcn.009687b0
test eax, eax
je 0x8ffd50
mov dword [ebp - 0x1560], esi
call fcn.00968930
test eax, eax
je 0x8ffd6d
cmp dword [0xbd4a9c], esi
je 0x8ffd67
mov dword [ebp - 0x1578], ebx
mov dword [ebp - 0x1570], esi
lea edx, [ebp - 0x156c]
push edx
push str.SecurityMode
mov ecx, str.SoftwareMicroWorldeConcealeConceal_FirewallCommon
mov edx, 0x80000002
call fcn.0094c0d0
lea eax, [ebp - 0x1558]
push eax
lea ecx, [ebp - 0x1538]
push ecx
mov bl, 0x2c
lea edi, [ebp - 0x224]
call fcn.0095ae80
add esp, 8
xor ebx, ebx
cmp dword [ebp - 0x1558], 0xffffffff
je 0x900490
mov dword [ebp - 0x154c], ebx
mov esi, 1
mov edi, esi
mov dword [ebp - 0x153c], edi
xor eax, eax
cmp eax, ebx
je 0x8ffde3
lea edx, [ebp - 0x224]
push edx
push str._REG___s
push ebx
call fcn.0096a780
add esp, 0xc
cmp dword [ebp - 0x1564], ebx
je 0x8ffe19
mov eax, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWindows
lea ecx, [ebp - 0x224]
call fcn.0094c330
test eax, eax
jne 0x8ffe19
cmp eax, ebx
je 0x8ffe11
push str._REG__FALSE__a0_
push ebx
call fcn.0096a780
add esp, 8
xor edi, edi
mov dword [ebp - 0x153c], edi
cmp dword [0xb567dc], esi
je 0x8ffe31
cmp dword [ebp - 0x1598], ebx
je 0x8ffe31
cmp dword [ebp - 0x156c], esi
je 0x8ffe5f
mov eax, str._REGISTRYCCSTServiceseconceal
lea ecx, [ebp - 0x224]
call fcn.0094c330
test eax, eax
jne 0x8ffe5f
cmp eax, ebx
je 0x8ffe57
push str._REG__FALSE__a1_
push ebx
call fcn.0096a780
add esp, 8
xor edi, edi
mov dword [ebp - 0x153c], edi
cmp dword [ebp - 0x1560], ebx
jne 0x8ffe70
call fcn.00968a20
test eax, eax
je 0x8ffeaa
mov dword [ebp - 0x155c], ebx
mov dword [ebp - 0x1568], ebx
mov eax, str._REGISTRYMACHINESYSTEMWPA
lea ecx, [ebp - 0x224]
call fcn.0094c330
test eax, eax
jne 0x8ffeaa
cmp eax, ebx
je 0x8ffea2
push str._REG__FALSE__a2_
push ebx
call fcn.0096a780
add esp, 8
xor edi, edi
mov dword [ebp - 0x153c], edi
cmp dword [ebp - 0x1568], ebx
je 0x8ffeba
cmp dword [ebp - 0x1570], ebx
je 0x8ffefe
mov eax, str.REGISTRYCCSTServicesWinSock2
lea ecx, [ebp - 0x224]
call fcn.0094c330
test eax, eax
je 0x8ffee2
mov eax, str.REGISTRYCCSTServicesWinSock
lea ecx, [ebp - 0x224]
call fcn.0094c330
test eax, eax
jne 0x8ffefe
xor eax, eax
cmp eax, ebx
je 0x8ffef6
push str._REG__FALSE__a4_
push ebx
call fcn.0096a780
add esp, 8
xor edi, edi
mov dword [ebp - 0x153c], edi
push ebx
push str.Extensions
lea eax, [ebp - 0x224]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8fff4c
push ebx
push str.Internet_Explorer_
lea ecx, [ebp - 0x224]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8fff4c
push ebx
push str.Explorer_
lea edx, [ebp - 0x224]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8fff7a
mov dword [ebp - 0x154c], esi
cmp edi, ebx
je 0x8fff7a
cmp dword [0xbd4ab0], ebx
jne 0x8fff7a
xor eax, eax
cmp eax, ebx
je 0x8fff72
push str._REG__FALSE__a5_
push ebx
call fcn.0096a780
add esp, 8
xor edi, edi
mov dword [ebp - 0x153c], edi
push ebx
push str.TimeZoneInformation
lea eax, [ebp - 0x224]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8fffbb
cmp dword [0xbd4ab8], ebx
jne 0x8fffbb
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a6_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
cmp edi, ebx
je 0x8ffd88
cmp dword [ebp - 0x1594], ebx
jne 0x900004
push ebx
push str.ClassesAppId
lea ecx, [ebp - 0x224]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x900004
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a7_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
cmp dword [ebp - 0x158c], ebx
jne 0x900045
push ebx
push str.Image_File_Execution_Options
lea edx, [ebp - 0x224]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x900045
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a8_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
cmp dword [ebp - 0x1580], ebx
jne 0x90008a
push ebx
push str.ClassesCLSID
lea eax, [ebp - 0x224]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x90008a
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a9_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
cmp dword [ebp - 0x1588], ebx
jne 0x9000cf
push ebx
push str.CCSTServices
lea ecx, [ebp - 0x224]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9000cf
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a10_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
cmp dword [ebp - 0x1578], ebx
jne 0x900114
push ebx
push str.CurrentVersionWinlogon
lea edx, [ebp - 0x224]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x900114
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a11_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
cmp dword [ebp - 0x1590], ebx
jne 0x900159
push ebx
push str.CurrentVersionWindows
lea eax, [ebp - 0x224]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x900159
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a12_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
cmp dword [ebp - 0x155c], ebx
jne 0x90019e
push ebx
push str.CurrentVersionSvcHost
lea ecx, [ebp - 0x224]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x90019e
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a13_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
cmp dword [ebp - 0x157c], ebx
jne 0x9001e3
push ebx
push str.CCSTControl
lea edx, [ebp - 0x224]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9001e3
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a14_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
cmp dword [ebp - 0x1584], ebx
jne 0x900228
push ebx
push str.MACHINESYSTEM
lea eax, [ebp - 0x224]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x900228
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a15_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
cmp edi, ebx
je 0x8ffd88
cmp dword [ebp - 0x1540], ebx
je 0x90025f
cmp dword [ebp - 0x154c], ebx
je 0x90025f
xor eax, eax
cmp eax, ebx
je 0x900254
push str._REG__FALSE__a16_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x900347
lea ecx, [ebp - 0x634]
push ecx
xor edx, edx
lea ecx, [ebp - 0x224]
call fcn.008ff7e0
add esp, 4
cmp byte [ebp - 0x634], bl
je 0x900324
push 0x80000002
lea eax, [ebp - 0x1554]
mov ecx, esi
lea edx, [ebp - 0x634]
call fcn.0097f000
add esp, 4
cmp eax, ebx
je 0x90030f
cmp dword [ebp - 0x154c], ebx
je 0x9002ef
lea edx, [ebp - 0x1554]
push edx
lea eax, [ebp - 0x634]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x9002cf
mov ecx, dword [ebp - 0x1554]
push ecx
jmp 0x900316
xor eax, eax
cmp eax, ebx
je 0x900254
push str._REG__FALSE__a17_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x900347
xor eax, eax
cmp eax, ebx
je 0x900254
push str._REG__FALSE__a18_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x900347
mov edx, dword [ebp - 0x1554]
push edx
mov edi, esi
mov dword [ebp - 0x153c], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x900347
xor eax, eax
cmp eax, ebx
je 0x90033c
push str._REG__Adding__a_
push ebx
call fcn.0096a780
add esp, 8
lea ecx, [ebp - 0x224]
call fcn.008ff3b0
cmp dword [ebp - 0x1540], ebx
je 0x8ffd88
xor edi, edi
mov dword [ebp - 0x153c], esi
mov eax, str.REGISTRYMACHINESOFTWAREAVC3
lea ecx, [ebp - 0x224]
call fcn.0094c330
test eax, eax
jne 0x900373
mov edi, esi
jmp 0x900394
push str.REGISTRYMACHINESOFTWAREWow6432Node
push str.REGISTRYMACHINESOFTWARE
lea eax, [ebp - 0x224]
push eax
call fcn.0095e130
add esp, 0xc
test eax, eax
je 0x8ffd88
cmp dword [ebp - 0x1574], ebx
jne 0x9003a4
cmp edi, ebx
je 0x90046c
lea ecx, [ebp - 0x634]
push ecx
xor edx, edx
lea ecx, [ebp - 0x224]
call fcn.008ff7e0
add esp, 4
cmp byte [ebp - 0x634], bl
je 0x90046c
lea edx, [ebp - 0x1550]
push edx
push 0x20119
lea eax, [ebp - 0x634]
push eax
push 0x80000002
call fcn.0097eda0
cmp eax, ebx
je 0x900459
cmp dword [ebp - 0x154c], ebx
je 0x900436
lea eax, [ebp - 0x1550]
lea ecx, [ebp - 0x634]
mov edx, 0x80000002
call fcn.0097ee20
test eax, eax
jne 0x900413
mov ecx, dword [ebp - 0x1550]
push ecx
jmp 0x900460
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a19_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
xor eax, eax
cmp eax, ebx
je 0x8fffb0
push str._REG__FALSE__a20_
push ebx
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x153c], ebx
jmp 0x8ffd88
mov edx, dword [ebp - 0x1550]
push edx
mov dword [ebp - 0x153c], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp eax, ebx
je 0x900480
push str._REG__Adding__b_
push ebx
call fcn.0096a780
add esp, 8
lea ecx, [ebp - 0x224]
call fcn.008ff3b0
jmp 0x8ffd88
mov byte [ebp - 0x42c], bl
push 0x207
push ebx
lea edx, [ebp - 0x42b]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov esi, 0x400
mov dword [ebp - 0x1544], esi
push str.eScan_Updater
lea eax, [ebp - 0x1544]
lea edi, [ebp - 0xb38]
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edx, 0x80000002
call fcn.0094c020
cmp al, 1
jne 0x900518
push str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRuneScan_Updater
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1540], ebx
je 0x90050d
push str.REGISTRYMACHINESOFTWAREWow6432Node
push str.REGISTRYMACHINESOFTWARE
lea ecx, [ebp - 0x42c]
push ecx
call fcn.0095e130
add esp, 0xc
lea ecx, [ebp - 0x42c]
call fcn.008ff1c0
mov byte [ebp - 0xb38], bl
mov dword [ebp - 0x1544], esi
push str.eScan_Server
lea eax, [ebp - 0x1544]
lea edi, [ebp - 0xb38]
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edx, 0x80000002
call fcn.0094c020
cmp al, 1
jne 0x900586
push str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRuneScan_Server
lea edx, [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1540], ebx
je 0x90057b
push str.REGISTRYMACHINESOFTWAREWow6432Node
push str.REGISTRYMACHINESOFTWARE
lea eax, [ebp - 0x42c]
push eax
call fcn.0095e130
add esp, 0xc
lea ecx, [ebp - 0x42c]
call fcn.008ff1c0
mov byte [ebp - 0xb38], bl
mov dword [ebp - 0x1544], esi
push str.MailScan_Dispatcher
lea eax, [ebp - 0x1544]
lea edi, [ebp - 0xb38]
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edx, 0x80000002
call fcn.0094c020
cmp al, 1
jne 0x900620
push 0x104
lea ecx, [ebp - 0x738]
push ecx
push 0xaa1543
mov edx, str.eScanInstalledWithMailScanSupport
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x738], 0x31
jne 0x900620
push str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRunMailScan_Dispatcher
lea edx, [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1540], ebx
je 0x900615
push str.REGISTRYMACHINESOFTWAREWow6432Node
push str.REGISTRYMACHINESOFTWARE
lea eax, [ebp - 0x42c]
push eax
call fcn.0095e130
add esp, 0xc
lea ecx, [ebp - 0x42c]
call fcn.008ff1c0
cmp dword [0xbdd830], ebx
jne 0x900666
cmp dword [0xb2745c], 2
jne 0x900666
push 0xb27564
push str.ProtectInterfaces
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [0xb27564], ebx
je 0x900666
mov ecx, str.REGISTRYCCSTServicesTcpipParametersInterfaces
call fcn.008ff3b0
mov dword [0xbdd838], 1
call fcn.008ffa10
mov dword [0xbdd83c], 1
jmp 0x900696
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret