Function at 0x8f8740
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb15200
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x196c
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x434], bl
push 0x40f
push ebx
lea eax, [ebp - 0x433]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov ecx, 0x1e0
mov esi, str._REGISTRYMACHINESYSTEMControlSet001ControlSession_Manager__REGISTRYMACHINESYSTEMControlSet001ControlSafeBoot__REGISTRYMACHINESYSTEMControlSet001Control__REGISTRYMACHINESYSTEMControlSet001ControlLsa_REGISTRYMACHINESYSTEMControlSet001Services__REGISTRYMACHINESOFTWAREClassesPROTOCOLSFilter_text_html__REGISTRYMACHINESOFTWAREClassesexefile_shellopencommand__REGISTRYMACHINESOFTWAREMicrosoftRpcExtensions__REGISTRYMACHINESOFTWAREIObitUninstaller__REGISTRYMACHINESOFTWAREMicrosoftCommand_Processor__REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRun__REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce__REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesPrograms__REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun__REGISTRYMACHINESOFTWAREPoliciesGoogleChromeURLBlacklist__REGISTRYMACHINESOFTWAREPoliciesGoogleChrome__REGISTRYMACHINESOFTWAREPoliciesMicrosoftWindowsNetwork_Connections__REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionBITS_REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects__REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup__REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler__REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks__REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWindows_REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityATs_REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options__REGISTRYMACHINESOFTWAREClasseshttp_shellopenddeexec
lea edi, [ebp - 0x196c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7e
push ebx
lea ecx, [ebp - 0x11ea]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 4], ebx
push 0xb525d0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebp - 0x196c], bl
je 0x8f8e41
mov byte [ebp - 0x834], bl
push 0x3ff
push ebx
lea edx, [ebp - 0x833]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x1978], ebx
mov dword [ebp - 0x197c], 1
mov dword [ebp - 0x1980], ebx
cmp dword [ebp + 8], ebx
je 0x8f8818
call fcn.008f8660
lea eax, [ebp - 0x1980]
push eax
push str.ControlOnWin10
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
lea ecx, [ebp - 0x197c]
push ecx
push str.Current
mov ecx, str.SYSTEMSelect
mov edx, 0x80000002
call fcn.0094c0d0
mov edx, dword [ebp - 0x197c]
push edx
push str.ControlSet_03d
lea eax, [ebp - 0xd5c]
push eax
call fcn.00a78f30
add esp, 0xc
mov eax, 0xacb244
lea ecx, [ebp - 0xd5c]
call fcn.0094c330
test eax, eax
je 0x8f8898
lea ecx, [ebp - 0xd5c]
push ecx
push 0xacb244
lea edx, [ebp - 0x196c]
push edx
call fcn.0095e130
add esp, 0xc
lea eax, [ebp - 0x1978]
push eax
lea ecx, [ebp - 0x196c]
push ecx
mov bl, 0x2c
lea edi, [ebp - 0x834]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x1978], 0xffffffff
je 0x8f8e41
xor ebx, ebx
mov byte [ebp - 0x116c], bl
push 0x40f
push ebx
lea edx, [ebp - 0x116b]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x1970], ebx
mov dword [ebp - 0x1974], 1
lea edx, [ebp - 0x116c]
cmp byte [ebp - 0x834], 0x21
jne 0x8f8911
lea ecx, [ebp - 0x833]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x8f8905
jmp 0x8f8921
lea ecx, [ebp - 0x834]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x8f8917
call fcn.00968bc0
test eax, eax
jne 0x8f8944
mov eax, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWindows
lea ecx, [ebp - 0x116c]
call fcn.0094c330
test eax, eax
jne 0x8f8944
mov dword [ebp - 0x1974], ebx
call fcn.00968930
test eax, eax
je 0x8f896f
cmp dword [ebp - 0x1980], ebx
jne 0x8f896f
mov eax, str.REGISTRYMACHINESYSTEMControlSet001Control
lea ecx, [ebp - 0x116c]
call fcn.0094c330
test eax, eax
jne 0x8f896f
mov dword [ebp - 0x1974], ebx
lea ecx, [ebp - 0x116c]
call fcn.00960910
cmp dword [ebp - 0x1974], ebx
je 0x8f8b98
lea ebx, [ebp - 0x1970]
lea edi, [ebp - 0x116c]
call fcn.009704b0
cmp eax, 1
jne 0x8f8b96
mov esi, dword [ebp - 0x1970]
mov eax, esi
lea edx, [eax + 2]
jmp 0x8f89b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x8f89b0
sub eax, edx
sar eax, 1
add eax, eax
push esi
push eax
push 0
cmp dword [ebp + 8], 1
jne 0x8f8ab5
xor ebx, ebx
cmp byte [ebp - 0x834], 0x21
jne 0x8f89e7
push 0x2000206
call dword [0xb8dacc]
jmp 0x8f89f7
push 0x2000209
call dword [0xb8dacc]
mov ebx, 1
mov edi, eax
add esp, 0x10
cmp dword [0xbc27fc], 0
je 0x8f8b7f
test edi, edi
jl 0x8f8a56
test ebx, ebx
je 0x8f8a26
lea eax, [ebp - 0x834]
push eax
push str._R_Successfully_Added_to_REGMON:__s
lea ecx, [ebp - 0x434]
push ecx
jmp 0x8f8a39
lea edx, [ebp - 0x834]
push edx
push str._NR_Successfully_Added_to_REGMON:__s
lea eax, [ebp - 0x434]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
mov ecx, dword [0xbc27fc]
push ecx
lea edx, [ebp - 0x434]
push edx
jmp 0x8f8b72
mov byte [ebp - 0xc54], 0
push 0x103
push 0
lea eax, [ebp - 0xc53]
push eax
call fcn.00a7ffb0
add esp, 0xc
push edi
lea edx, [ebp - 0xc54]
call fcn.008aaa40
add esp, 4
lea ecx, [ebp - 0x834]
lea edx, [ebp - 0x434]
cmp byte [ebp - 0xc54], 0
jne 0x8f8aa3
push edi
push ecx
push str.___Failed_To_add_to_REGMON___s_._Reason:_0x_x
jmp 0x8f8b5a
lea eax, [ebp - 0xc54]
push eax
push ecx
push str.___Failed_To_add_to_REGMON___s_._Reason:__s
jmp 0x8f8b5a
push 0x2000207
call dword [0xb8dacc]
add esp, 0x10
mov edi, eax
cmp dword [0xbc27fc], 0
je 0x8f8b7f
test edi, edi
jl 0x8f8b03
lea edx, [ebp - 0x834]
push edx
push str.Successfully_Removed_from_REGMON:__s
lea eax, [ebp - 0x434]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
mov ecx, dword [0xbc27fc]
push ecx
lea edx, [ebp - 0x434]
push edx
jmp 0x8f8b72
mov byte [ebp - 0x93c], 0
push 0x103
push 0
lea eax, [ebp - 0x93b]
push eax
call fcn.00a7ffb0
add esp, 0xc
push edi
lea edx, [ebp - 0x93c]
call fcn.008aaa40
add esp, 4
lea ecx, [ebp - 0x834]
lea edx, [ebp - 0x434]
cmp byte [ebp - 0x93c], 0
jne 0x8f8b4d
push edi
push ecx
push str.___Failed_To_Remove_from_REGMON___s_._Reason:_0x_x
jmp 0x8f8b5a
lea eax, [ebp - 0x93c]
push eax
push ecx
push str.___Failed_To_Remove_from_REGMON___s_._Reason:__s
push edx
call fcn.00a78f30
add esp, 0x10
push 0
mov eax, dword [0xbc27fc]
push eax
lea ecx, [ebp - 0x434]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test esi, esi
je 0x8f8b96
push esi
call fcn.00a78fec
add esp, 4
mov dword [ebp - 0x1970], 0
xor ebx, ebx
cmp dword [0xb56800], ebx
je 0x8f8c47
cmp dword [ebp - 0x1974], ebx
je 0x8f8c47
mov eax, str.REGISTRYMACHINESOFTWARE_
lea ecx, [ebp - 0x116c]
call fcn.0094c3e0
test eax, eax
jne 0x8f8c47
mov dword [ebp - 0x1974], 1
push str.REGISTRYMACHINESOFTWAREWow6432Node
push str.REGISTRYMACHINESOFTWARE
lea edx, [ebp - 0x116c]
push edx
call fcn.0095e130
add esp, 0xc
lea ebx, [ebp - 0x1970]
lea edi, [ebp - 0x116c]
call fcn.009704b0
cmp eax, 1
jne 0x8f8e0f
mov esi, dword [ebp - 0x1970]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x8f8c10
sub eax, edx
sar eax, 1
add eax, eax
push esi
push eax
push 0
cmp dword [ebp + 8], 1
jne 0x8f8d2e
xor ebx, ebx
cmp byte [ebp - 0x834], 0x21
jne 0x8f8c60
push 0x2000206
call dword [0xb8dacc]
jmp 0x8f8c70
mov dword [ebp - 0x1974], ebx
lea edx, [ebp - 0x1978]
push edx
lea eax, [ebp - 0x196c]
push eax
jmp 0x8f88a6
push 0x2000209
call dword [0xb8dacc]
mov ebx, 1
mov edi, eax
add esp, 0x10
cmp dword [0xbc27fc], 0
je 0x8f8df8
test edi, edi
jl 0x8f8ccf
test ebx, ebx
je 0x8f8c9f
lea eax, [ebp - 0x834]
push eax
push str._R_Successfully_Added_to_REGMON:__s
lea ecx, [ebp - 0x434]
push ecx
jmp 0x8f8cb2
lea edx, [ebp - 0x834]
push edx
push str._NR_Successfully_Added_to_REGMON:__s
lea eax, [ebp - 0x434]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
mov ecx, dword [0xbc27fc]
push ecx
lea edx, [ebp - 0x434]
push edx
jmp 0x8f8deb
mov byte [ebp - 0xb4c], 0
push 0x103
push 0
lea eax, [ebp - 0xb4b]
push eax
call fcn.00a7ffb0
add esp, 0xc
push edi
lea edx, [ebp - 0xb4c]
call fcn.008aaa40
add esp, 4
lea ecx, [ebp - 0x834]
lea edx, [ebp - 0x434]
cmp byte [ebp - 0xb4c], 0
jne 0x8f8d1c
push edi
push ecx
push str.___Failed_To_add_to_REGMON___s_._Reason:_0x_x
jmp 0x8f8dd3
lea eax, [ebp - 0xb4c]
push eax
push ecx
push str.___Failed_To_add_to_REGMON___s_._Reason:__s
jmp 0x8f8dd3
push 0x2000207
call dword [0xb8dacc]
add esp, 0x10
mov edi, eax
cmp dword [0xbc27fc], 0
je 0x8f8df8
test edi, edi
jl 0x8f8d7c
lea edx, [ebp - 0x834]
push edx
push str.Successfully_Removed_from_REGMON:__s
lea eax, [ebp - 0x434]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
mov ecx, dword [0xbc27fc]
push ecx
lea edx, [ebp - 0x434]
push edx
jmp 0x8f8deb
mov byte [ebp - 0xa44], 0
push 0x103
push 0
lea eax, [ebp - 0xa43]
push eax
call fcn.00a7ffb0
add esp, 0xc
push edi
lea edx, [ebp - 0xa44]
call fcn.008aaa40
add esp, 4
lea ecx, [ebp - 0x834]
lea edx, [ebp - 0x434]
cmp byte [ebp - 0xa44], 0
jne 0x8f8dc6
push edi
push ecx
push str.___Failed_To_Remove_from_REGMON___s_._Reason:_0x_x
jmp 0x8f8dd3
lea eax, [ebp - 0xa44]
push eax
push ecx
push str.___Failed_To_Remove_from_REGMON___s_._Reason:__s
push edx
call fcn.00a78f30
add esp, 0x10
push 0
mov eax, dword [0xbc27fc]
push eax
lea ecx, [ebp - 0x434]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test esi, esi
je 0x8f8e0f
push esi
call fcn.00a78fec
add esp, 4
mov dword [ebp - 0x1970], 0
lea edx, [ebp - 0x1978]
push edx
lea eax, [ebp - 0x196c]
push eax
jmp 0x8f88a6
push 0xb525d0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret