Function at 0x4a9f70
Capabilities:
Enumerate processes
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5947bc
mov eax, dword fs:[0]
push eax
sub esp, 0xb68
mov eax, dword [0x5fae30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xb48], ebx
xor edi, edi
mov esi, ecx
mov dword [ebp - 0xb6c], eax
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xb64], edi
mov dword [ebp - 0xb60], ebx
lea ecx, [ebp - 0xb70]
push ecx
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServices
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x4aa097
push eax
lea edx, [ebp - 0x94c]
push edx
call fcn.004080a8
push eax
lea eax, [ebp - 0x930]
push str.COperationsManager::GetKomodias___Failed_to_get_key_with_error:
push eax
mov byte [ebp - 4], 1
call fcn.0040367f
add esp, 0x14
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00403bd4
mov esi, 0x10
cmp dword [ebp - 0x91c], esi
jb 0x4aa03c
mov ecx, dword [ebp - 0x930]
push ecx
call fcn.0053ed60
add esp, 4
mov dword [ebp - 0x91c], 0xf
mov dword [ebp - 0x920], ebx
mov byte [ebp - 0x930], bl
cmp dword [ebp - 0x938], esi
jb 0x4aa069
mov edx, dword [ebp - 0x94c]
push edx
call fcn.0053ed60
add esp, 4
mov esi, dword [ebp - 0xb6c]
lea eax, [ebp - 0xb68]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
cmp esi, eax
je 0x4aa090
mov ecx, esi
call fcn.004021ee
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, esi
jmp 0x4aa8bd
push 0x103
lea ecx, [ebp - 0x113]
push ebx
push ecx
mov dword [ebp - 0xb58], ebx
mov byte [ebp - 0x114], bl
call fcn.005409b0
mov eax, dword [ebp - 0xb70]
add esp, 0xc
push 0x104
lea edx, [ebp - 0x114]
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, 0xf
test eax, eax
jne 0x4aa570
lea edi, [esi + 1]
mov eax, dword [ebp - 0xb70]
inc dword [ebp - 0xb58]
lea ecx, [ebp - 0xb50]
push ecx
push 0x20019
push ebx
lea edx, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4aa542
lea ecx, [ebp - 0xb54]
push ecx
mov ecx, dword [ebp - 0xb50]
lea edx, [ebp - 0xb74]
push edx
lea eax, [ebp - 0xb4c]
push eax
push ebx
push 0x5b7c54
push ecx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xb54], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4aa535
xor edx, edx
mov dword [ebp - 0xa04], esi
mov dword [ebp - 0xa08], ebx
mov byte [ebp - 0xa18], bl
mov dword [ebp - 0x9e8], esi
mov dword [ebp - 0x9ec], ebx
mov byte [ebp - 0x9fc], bl
mov dword [ebp - 0x9cc], esi
mov dword [ebp - 0x9d0], ebx
mov byte [ebp - 0x9e0], bl
mov dword [ebp - 0x9b0], 7
mov dword [ebp - 0x9b4], ebx
mov word [ebp - 0x9c4], dx
mov dword [ebp - 0x9a8], ebx
mov byte [ebp - 0x9a4], bl
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 3
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4aa1c0
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0xa18]
call fcn.00402a36
lea ecx, [ebp - 0xb54]
push ecx
mov ecx, dword [ebp - 0xb50]
lea edx, [ebp - 0x914]
push edx
lea eax, [ebp - 0xb4c]
push eax
push ebx
push str.ImagePath
push ecx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xb54], 0x7fe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4aa3e9
lea eax, [ebp - 0x914]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4aa225
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x914]
push edx
lea ecx, [ebp - 0x9c4]
call fcn.00403594
mov dword [ebp - 0x938], esi
mov dword [ebp - 0x93c], ebx
mov byte [ebp - 0x94c], bl
mov dword [ebp - 0x98c], esi
mov dword [ebp - 0x990], ebx
mov byte [ebp - 0x9a0], bl
xor eax, eax
mov word [ebp - 0x930], ax
lea eax, [ebp - 0x914]
mov byte [ebp - 4], 5
mov dword [ebp - 0x91c], 7
mov dword [ebp - 0x920], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x4aa291
sub eax, ecx
sar eax, 1
push eax
lea ecx, [ebp - 0x914]
push ecx
lea ecx, [ebp - 0x930]
call fcn.00403594
push 1
push 0x5b7cb8
lea ecx, [ebp - 0x984]
mov byte [ebp - 4], 6
mov dword [ebp - 0x970], esi
mov dword [ebp - 0x974], ebx
mov byte [ebp - 0x984], bl
call fcn.00402a36
lea edx, [ebp - 0x930]
push edx
lea eax, [ebp - 0x968]
push eax
mov byte [ebp - 4], 7
call fcn.00406569
lea ecx, [ebp - 0x9a0]
push ecx
lea edx, [ebp - 0x94c]
push edx
push eax
lea eax, [ebp - 0x984]
push eax
mov byte [ebp - 4], 8
call fcn.004051e6
add esp, 0x18
mov byte [ebp - 0xb41], al
cmp dword [ebp - 0x954], edi
jb 0x4aa331
mov ecx, dword [ebp - 0x968]
push ecx
call fcn.0053ed60
add esp, 4
mov dword [ebp - 0x954], esi
mov dword [ebp - 0x958], ebx
mov byte [ebp - 0x968], bl
cmp dword [ebp - 0x970], edi
jb 0x4aa35a
mov edx, dword [ebp - 0x984]
push edx
call fcn.0053ed60
add esp, 4
cmp dword [ebp - 0x91c], 8
mov dword [ebp - 0x970], esi
mov dword [ebp - 0x974], ebx
mov byte [ebp - 0x984], bl
mov byte [ebp - 4], 5
jb 0x4aa388
mov eax, dword [ebp - 0x930]
push eax
call fcn.0053ed60
add esp, 4
cmp byte [ebp - 0xb41], bl
je 0x4aa3a5
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x9a0]
push ecx
lea ecx, [ebp - 0x9e0]
call fcn.004077b1
cmp dword [ebp - 0x98c], edi
jb 0x4aa3bc
mov edx, dword [ebp - 0x9a0]
push edx
call fcn.0053ed60
add esp, 4
mov dword [ebp - 0x98c], esi
mov dword [ebp - 0x990], ebx
mov byte [ebp - 0x9a0], bl
mov byte [ebp - 4], 3
cmp dword [ebp - 0x938], edi
jb 0x4aa3e9
mov eax, dword [ebp - 0x94c]
push eax
call fcn.0053ed60
add esp, 4
lea ecx, [ebp - 0xb54]
push ecx
mov ecx, dword [ebp - 0xb50]
lea edx, [ebp - 0x914]
push edx
lea eax, [ebp - 0xb4c]
push eax
push ebx
push 0x5b7cbc
push ecx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xb54], 0x7fe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4aa4e1
xor edx, edx
lea eax, [ebp - 0x914]
mov word [ebp - 0x930], dx
mov dword [ebp - 0x91c], 7
mov dword [ebp - 0x920], ebx
lea edx, [eax + 2]
jmp 0x4aa450
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4aa450
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x914]
push eax
lea ecx, [ebp - 0x930]
call fcn.00403594
lea ecx, [ebp - 0x930]
push ecx
lea edx, [ebp - 0x94c]
push edx
mov byte [ebp - 4], 9
call fcn.00406569
add esp, 8
push eax
lea ecx, [ebp - 0x9fc]
mov byte [ebp - 4], 0xa
call fcn.00401604
cmp dword [ebp - 0x938], edi
jb 0x4aa4b3
mov eax, dword [ebp - 0x94c]
push eax
call fcn.0053ed60
add esp, 4
cmp dword [ebp - 0x91c], 8
mov dword [ebp - 0x938], esi
mov dword [ebp - 0x93c], ebx
mov byte [ebp - 0x94c], bl
mov byte [ebp - 4], 3
jb 0x4aa4e1
mov ecx, dword [ebp - 0x930]
push ecx
call fcn.0053ed60
add esp, 4
cmp dword [ebp - 0x9ec], ebx
je 0x4aa503
lea edx, [ebp - 0xa18]
push edx
lea ecx, [ebp - 0xb68]
call fcn.00403e81
cmp dword [ebp - 0x9ec], ebx
jne 0x4aa527
push 7
push str.pcproxy
lea ecx, [ebp - 0x9fc]
call fcn.00402a36
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0xb68]
call fcn.00403e81
lea ecx, [ebp - 0xa18]
mov byte [ebp - 4], bl
call fcn.004044c1
mov ecx, dword [ebp - 0xb50]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xb58]
mov ecx, dword [ebp - 0xb70]
push 0x104
lea edx, [ebp - 0x114]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x4aa0e2
mov edi, dword [ebp - 0xb64]
mov edx, dword [ebp - 0xb70]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xb68], edi
je 0x4aa858
push 0x124
lea eax, [ebp - 0xb3c]
push ebx
push eax
mov dword [ebp - 0xb40], ebx
call fcn.005409b0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xb54], eax
cmp eax, 0xffffffff
jne 0x4aa5dd
mov esi, dword [ebp - 0xb6c]
lea ecx, [ebp - 0xb68]
push ecx
mov ecx, esi
call fcn.00401a4b
lea ecx, [ebp - 0xb68]
call fcn.004068d9
mov eax, esi
jmp 0x4aa8bd
lea edx, [ebp - 0xb40]
push edx
push eax
mov dword [ebp - 0xb40], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4aa84b
mov ecx, edi
sub ecx, dword [ebp - 0xb68]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [ebp - 0xb4c], esi
lea ecx, [ecx]
mov dword [ebp - 0xb58], ebx
cmp esi, ebx
jbe 0x4aa830
mov eax, dword [ebp - 0xb68]
add eax, 0x38
mov dword [ebp - 0xb50], eax
lea ecx, [ecx]
mov ecx, dword [ebp - 0xb50]
cmp dword [ecx + 0x10], ebx
je 0x4aa72e
lea eax, [ebp - 0xb1c]
mov dword [ebp - 0x91c], 0xf
mov dword [ebp - 0x920], ebx
mov byte [ebp - 0x930], bl
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4aa670
sub eax, esi
push eax
lea edx, [ebp - 0xb1c]
push edx
lea ecx, [ebp - 0x930]
call fcn.00402a36
mov eax, dword [ebp - 0xb50]
or dword [ebp - 0xb48], 2
push eax
lea ecx, [ebp - 0x968]
push ecx
mov byte [ebp - 4], 0xb
call fcn.004069b0
mov esi, eax
or dword [ebp - 0xb48], 4
lea edx, [ebp - 0x930]
push edx
lea eax, [ebp - 0x94c]
push eax
mov dword [ebp - 4], 0xc
call fcn.004069b0
add esp, 0x10
or dword [ebp - 0xb48], 8
cmp dword [esi + 0x14], 0x10
mov edi, dword [esi + 0x10]
jb 0x4aa6e4
mov edx, dword [esi]
jmp 0x4aa6e6
mov edx, esi
mov esi, dword [eax + 0x10]
mov ecx, esi
cmp ecx, esi
jae 0x4aa6ef
mov ecx, esi
cmp esi, edi
jb 0x4aa6f7
mov ecx, edi
cmp dword [eax + 0x14], 0x10
jb 0x4aa6ff
mov eax, dword [eax]
push ecx
push edx
push eax
call fcn.0040392c
add esp, 0xc
cmp eax, ebx
jne 0x4aa720
cmp esi, edi
jae 0x4aa717
or eax, 0xffffffff
jmp 0x4aa71e
xor eax, eax
cmp esi, edi
setne al
cmp eax, ebx
sete al
mov byte [ebp - 0xb41], 1
cmp al, bl
jne 0x4aa734
mov byte [ebp - 0xb41], bl
test byte [ebp - 0xb48], 8
mov esi, 0x10
je 0x4aa776
and dword [ebp - 0xb48], 0xfffffff7
cmp dword [ebp - 0x938], esi
jb 0x4aa760
mov ecx, dword [ebp - 0x94c]
push ecx
call fcn.0053ed60
add esp, 4
mov dword [ebp - 0x938], 0xf
mov dword [ebp - 0x93c], ebx
mov byte [ebp - 0x94c], bl
test byte [ebp - 0xb48], 4
je 0x4aa7b3
and dword [ebp - 0xb48], 0xfffffffb
cmp dword [ebp - 0x954], esi
jb 0x4aa79d
mov edx, dword [ebp - 0x968]
push edx
call fcn.0053ed60
add esp, 4
mov dword [ebp - 0x954], 0xf
mov dword [ebp - 0x958], ebx
mov byte [ebp - 0x968], bl
test byte [ebp - 0xb48], 2
mov dword [ebp - 4], ebx
je 0x4aa7dd
and dword [ebp - 0xb48], 0xfffffffd
cmp dword [ebp - 0x91c], esi
jb 0x4aa7dd
mov eax, dword [ebp - 0x930]
push eax
call fcn.0053ed60
add esp, 4
mov eax, dword [ebp - 0xb58]
cmp byte [ebp - 0xb41], bl
jne 0x4aa807
add dword [ebp - 0xb50], 0x78
inc eax
mov dword [ebp - 0xb58], eax
cmp eax, dword [ebp - 0xb4c]
jb 0x4aa640
jmp 0x4aa824
mov edx, dword [ebp - 0xb68]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea eax, [edx + ecx*8]
mov byte [eax + 0x74], 1
mov ecx, dword [ebp - 0xb38]
mov dword [eax + 0x70], ecx
mov esi, dword [ebp - 0xb4c]
mov edi, dword [ebp - 0xb64]
mov eax, dword [ebp - 0xb54]
lea edx, [ebp - 0xb40]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4aa620
mov ecx, dword [ebp - 0xb54]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xb6c]
lea edx, [ebp - 0xb68]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
cmp eax, edx
je 0x4aa886
mov ecx, dword [ebp - 0xb68]
mov edx, dword [ebp - 0xb60]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
jmp 0x4aa8bd
cmp dword [ebp - 0xb68], ebx
je 0x4aa8bd
mov ebx, dword [ebp - 0xb68]
mov esi, ebx
cmp ebx, edi
je 0x4aa8ae
lea ebx, [ebx]
mov ecx, esi
call fcn.004044c1
add esi, 0x78
cmp esi, edi
jne 0x4aa8a0
push ebx
call fcn.0053ed60
mov eax, dword [ebp - 0xb6c]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053fd20
mov esp, ebp
pop ebp
ret 4