Function at 0x425e75
Capabilities:
Get hostname
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
push ebx
push esi
push edi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x13880
push 0x5dfac0
call fcn.004381a6
add esp, 0x14
mov dword [ebp - 0x220], 0x200
lea eax, [ebp - 0x424]
mov dword [eax], 0
mov byte [eax + 4], 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str._n_r________SofTrack_Local_Workstation_Service_Profile________
call fcn.00452380
add esp, 4
lea eax, [ebp - 0x424]
push eax
push str._n_r________COMPUTER_:__s
call fcn.00452380
add esp, 8
push 0x473980
call fcn.00452380
add esp, 4
push str.SofTrack_NT_W2K_TSE_XP_RDC_VISTA_WIN7_8_10_11_Local_Metering_Agent_n_rVersion_7.30e
push str._n_r_S
call fcn.00452380
add esp, 8
push 0x473a6c
call fcn.00452380
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x478], eax
mov ecx, 0x3e8
mov eax, dword [ebp - 0x478]
sub edx, edx
div ecx
mov dword [ebp - 0x478], eax
push 0
call fcn.00452990
add esp, 4
sub eax, dword [ebp - 0x478]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x478]
push eax
call fcn.00411b8f
add esp, 4
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x478]
push eax
call fcn.00452eb0
add esp, 4
lea edi, [ebp - 0x474]
mov esi, eax
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x460], 0x63
jle 0x425fae
mov eax, dword [ebp - 0x460]
sub eax, 0x64
mov dword [ebp - 0x47c], eax
jmp 0x425fba
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x478]
push eax
mov eax, dword [ebp - 0x470]
push eax
mov eax, dword [ebp - 0x46c]
push eax
mov eax, dword [ebp - 0x47c]
push eax
mov eax, dword [ebp - 0x468]
push eax
mov eax, dword [ebp - 0x464]
inc eax
push eax
push str._n_rWindows_Last_Started:__d__d__02d____d:_02d_______x_
call fcn.00452380
add esp, 0x1c
push 0x473ae4
call fcn.00452380
add esp, 4
lea eax, [ebp - 0x450]
push eax
push 0x20019
push 0
push 0x473b24
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x426076
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x426051
push str._nUsage_of_this_file_is_intended_only_for_Windows_NT_2000_XP_or_later_systems.
call fcn.00452380
add esp, 4
jmp 0x42606c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x208]
push eax
push 0x473bb0
call fcn.00452380
add esp, 0xc
mov eax, 0xff
jmp 0x42735c
mov dword [ebp - 0x220], 0x200
mov byte [ebp - 0x423], 0
mov al, byte [ebp - 0x423]
mov byte [ebp - 0x424], al
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0
push 0x473bd8
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x4260d9
movsx eax, byte [ebp - 0x424]
test eax, eax
jne 0x4260eb
push str._nLocation_Code_is_not_set
call fcn.00452380
add esp, 4
jmp 0x426141
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x424]
push eax
push str._nLocation_Code___s___d_
call fcn.00452380
add esp, 0xc
movsx eax, byte [ebp - 0x424]
cmp eax, 0x20
jne 0x426141
movsx eax, byte [ebp - 0x423]
test eax, eax
jne 0x426141
push 0x473c1c
push 0
call fcn.0042af0e
add esp, 8
push str._r_nLocation_Code_BLANK_reset
call fcn.00452380
add esp, 4
mov dword [ebp - 0x220], 0x200
mov byte [ebp - 0x423], 0
mov al, byte [ebp - 0x423]
mov byte [ebp - 0x424], al
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0
push 0x473c3c
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x4261a4
movsx eax, byte [ebp - 0x424]
test eax, eax
jne 0x4261a9
jmp 0x4261c4
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x424]
push eax
push str._nClient_Group_Prefix___s___d_
call fcn.00452380
add esp, 0xc
mov dword [ebp - 0x220], 0x200
mov byte [ebp - 0x423], 0
mov al, byte [ebp - 0x423]
mov byte [ebp - 0x424], al
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0
push 0x473c68
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x424]
push eax
push str._nServer_to_connect_to___s___d_
call fcn.00452380
add esp, 0xc
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 4
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x473c94
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x426280
mov dword [0x462194], 0
jmp 0x42628b
mov eax, dword [ebp - 0x224]
mov dword [0x462194], eax
mov eax, 0x473cb4
mov ecx, 0x473cb8
xor edx, edx
cmp dword [0x462194], 0
setne dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
push str.__convert_to_IP___s__
call fcn.00452380
add esp, 8
push 0x473cd4
call fcn.00452380
add esp, 4
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 4
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x473d14
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
push eax
mov eax, str.Remote__Local
mov ecx, str.Local_Only
xor edx, edx
cmp dword [ebp - 0x224], 0
setne dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
push str._nLocal___Remote_Action___s___d_
call fcn.00452380
add esp, 0xc
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 4
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x473d5c
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
push eax
mov eax, str.No_AD_Group_Tracking
mov ecx, str.Will_attempt_AD_Group_Tracking_default_
xor edx, edx
cmp dword [ebp - 0x224], 0
setne dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
push str._nNoADGroupTracking_Action___s___d_
call fcn.00452380
add esp, 0xc
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 4
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x473dd4
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x426400
push str._nNo_Load_Delay
call fcn.00452380
add esp, 4
jmp 0x42641b
mov eax, dword [ebp - 0x208]
push eax
mov eax, dword [ebp - 0x224]
push eax
push str._nLoad_Delay_is___d___d_
call fcn.00452380
add esp, 0xc
push 0x473e08
call fcn.00452380
add esp, 4
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 4
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x473e48
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x426482
mov dword [0x46216c], 0
jmp 0x42648d
mov eax, dword [ebp - 0x224]
mov dword [0x46216c], eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 4
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x473e5c
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x4264e7
mov dword [0x462174], 0
jmp 0x4264f2
mov eax, dword [ebp - 0x224]
mov dword [0x462174], eax
push 0x473e70
call fcn.00452380
add esp, 4
mov dword [ebp - 0x220], 0x200
mov byte [ebp - 0x423], 0
mov al, byte [ebp - 0x423]
mov byte [ebp - 0x424], al
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0
push 0x473eb0
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x426665
cmp dword [ebp - 0x428], 0
je 0x4265c5
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x4265c0
push 0x200
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004280cc
add esp, 0xc
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
jmp 0x4265fc
push 0x200
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004280cc
add esp, 0xc
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x424]
push eax
push 0x473ebc
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x218], 0
je 0x42662f
push 0x473ed0
call fcn.004535b0
add esp, 4
jmp 0x426660
mov eax, dword [ebp - 0x438]
push eax
push 0x473ef0
call fcn.00452380
add esp, 8
lea eax, [ebp - 0x430]
push eax
call fcn.00453370
add esp, 4
push eax
push 0x473f08
call fcn.00452380
add esp, 8
jmp 0x426680
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x424]
push eax
push 0x473f20
call fcn.00452380
add esp, 0xc
mov dword [ebp - 0x220], 0x200
mov byte [ebp - 0x423], 0
mov al, byte [ebp - 0x423]
mov byte [ebp - 0x424], al
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0
push 0x473f38
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x4268cc
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x428], 0
je 0x426793
lea edi, [ebp - 0x424]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x426777
dec dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
movsx eax, byte [ebp + eax - 0x424]
cmp eax, 0x5c
jne 0x426772
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
mov byte [ebp + eax - 0x424], 0
mov edx, 0x473f44
lea edi, [ebp - 0x424]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov dword [edi + 8], eax
mov dword [ebp - 0x21c], 0
jmp 0x426705
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x426863
push 0x200
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004280cc
add esp, 0xc
lea edi, [ebp - 0x424]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x426847
dec dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
movsx eax, byte [ebp + eax - 0x424]
cmp eax, 0x5c
jne 0x426842
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
mov byte [ebp + eax - 0x424], 0
mov edx, str.NWLWA32.EXE
lea edi, [ebp - 0x424]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov dword [edi + 8], eax
mov dword [ebp - 0x21c], 0
jmp 0x4267d5
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x424]
push eax
push 0x473f5c
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x218], 0
je 0x426896
push 0x473f70
call fcn.004535b0
add esp, 4
jmp 0x4268c7
mov eax, dword [ebp - 0x438]
push eax
push 0x473f90
call fcn.00452380
add esp, 8
lea eax, [ebp - 0x430]
push eax
call fcn.00453370
add esp, 4
push eax
push 0x473fa8
call fcn.00452380
add esp, 8
jmp 0x4268e7
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x424]
push eax
push str._nEXE_ImagePath___s___d_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x473fd8
call fcn.00452380
add esp, 4
cmp dword [ebp - 0x428], 0
je 0x426937
lea eax, [ebp - 0x450]
push eax
push 0x20019
push 0
push 0x474018
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x208], eax
jmp 0x426991
cmp dword [0x462280], 0
je 0x42696d
lea eax, [ebp - 0x450]
push eax
push 0x20019
push 0
push 0x474044
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x208], eax
jmp 0x426991
lea eax, [ebp - 0x450]
push eax
push 0x20019
push 0
push 0x474070
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x4269c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x208]
push eax
push 0x47409c
call fcn.00452380
add esp, 0xc
mov eax, 0xff
jmp 0x42735c
mov dword [ebp - 0x220], 0x200
mov byte [ebp - 0x423], 0
mov al, byte [ebp - 0x423]
mov byte [ebp - 0x424], al
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0
push 0x4740c4
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
mov byte [ebp - 0x200], 0
cmp dword [ebp - 0x208], 0
jne 0x426edb
cmp dword [ebp - 0x428], 0
je 0x426c95
movsx eax, byte [ebp - 0x423]
cmp eax, 0x3f
jne 0x426a76
movsx eax, byte [ebp - 0x422]
cmp eax, 0x3f
jne 0x426a76
lea edi, [ebp - 0x420]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x424]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4740d0
lea eax, [ebp - 0x424]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x426acc
push 0x4740f0
lea eax, [ebp - 0x424]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x426ac7
push 0x200
lea eax, [ebp - 0x424]
push eax
push str.SystemRoot_sysnativedrivers_stlwa_64.sys
call fcn.004280cc
add esp, 0xc
jmp 0x426ae7
push 0x200
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004280cc
add esp, 0xc
lea edi, [ebp - 0x424]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x200]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x21c], 0
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x214], eax
jle 0x426c22
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
movsx eax, byte [ebp + eax - 0x1f7]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x21c]
mov byte [ebp + eax - 0x1f7], 0
push 0x474120
mov eax, dword [ebp - 0x21c]
lea eax, [ebp + eax - 0x200]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x426c0a
mov eax, 0x47412c
mov ecx, dword [ebp - 0x21c]
lea ecx, [ebp + ecx - 0x200]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov dx, word [eax + 8]
mov word [ecx + 8], dx
mov al, byte [eax + 0xa]
mov byte [ecx + 0xa], al
mov eax, dword [ebp - 0x21c]
lea edi, [ebp + eax - 0x41b]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x214], 0
jmp 0x426c1d
mov al, byte [ebp - 0x20c]
mov ecx, dword [ebp - 0x21c]
mov byte [ebp + ecx - 0x1f7], al
jmp 0x426b36
lea eax, [ebp - 0x424]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
push 0x200
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.004280cc
add esp, 0xc
movsx eax, byte [ebp - 0x424]
test eax, eax
je 0x426c90
lea edi, [ebp - 0x424]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x200]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x426d51
cmp dword [0x462280], 0
je 0x426cfc
push 0x474138
lea eax, [ebp - 0x424]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x426cdc
push 0x200
lea eax, [ebp - 0x424]
push eax
push 0x474158
call fcn.004280cc
add esp, 0xc
jmp 0x426cf7
push 0x200
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004280cc
add esp, 0xc
jmp 0x426d51
push 0x474184
lea eax, [ebp - 0x424]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x426d36
push 0x200
lea eax, [ebp - 0x424]
push eax
push 0x4741a4
call fcn.004280cc
add esp, 0xc
jmp 0x426d51
push 0x200
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004280cc
add esp, 0xc
cmp dword [ebp - 0x428], 0
je 0x426dbf
movsx eax, byte [ebp - 0x200]
test eax, eax
je 0x426dbf
movsx eax, byte [ebp - 0x1ff]
cmp eax, 0x3f
jne 0x426d9e
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x1fc]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
jmp 0x426dba
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
jmp 0x426e0c
movsx eax, byte [ebp - 0x423]
cmp eax, 0x3f
jne 0x426df0
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
jmp 0x426e0c
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x424]
lea ecx, [ebp - 0x200]
movsx edx, byte [ebp - 0x424]
xor ebx, ebx
test edx, edx
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x4741d0
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x218], 0
je 0x426ea5
push 0x4741e4
call fcn.004535b0
add esp, 4
cmp dword [0x462284], 0
je 0x426e74
push str._n_rThe_file_STLWA_64.SYS_must_be_present_for_the_Local_Agent_to_function.
call fcn.00452380
add esp, 4
jmp 0x426ea0
cmp dword [0x462280], 0
je 0x426e93
push str._n_rThe_file_STVISTA.SYS_must_be_present_for_the_Local_Agent_to_function.
call fcn.00452380
add esp, 4
jmp 0x426ea0
push str._n_rThe_file_STLWMON.SYS_must_be_present_for_the_Local_Agent_to_function.
call fcn.00452380
add esp, 4
jmp 0x426ed6
mov eax, dword [ebp - 0x438]
push eax
push 0x4742e0
call fcn.00452380
add esp, 8
lea eax, [ebp - 0x430]
push eax
call fcn.00453370
add esp, 4
push eax
push 0x4742f8
call fcn.00452380
add esp, 8
jmp 0x426ef6
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x424]
push eax
push 0x474310
call fcn.00452380
add esp, 0xc
push str._n_r__________________________________________________________
call fcn.00452380
add esp, 4
cmp dword [ebp - 0x428], 0
je 0x426f39
lea eax, [ebp - 0x450]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesSTBW_K64
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x208], eax
jmp 0x426f5d
lea eax, [ebp - 0x450]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesSTBW_K32
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x426f8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x208]
push eax
push str._nERROR___d___d__Opening_STBW_Services_Key.
call fcn.00452380
add esp, 0xc
mov eax, 0xff
jmp 0x42735c
mov dword [ebp - 0x220], 0x200
mov byte [ebp - 0x423], 0
mov al, byte [ebp - 0x423]
mov byte [ebp - 0x424], al
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0
push 0x4743ec
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x427329
cmp dword [ebp - 0x428], 0
je 0x427185
push str.system32drivers_stbw_k64.sys
lea eax, [ebp - 0x424]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x42702a
push 0x200
lea eax, [ebp - 0x424]
push eax
push str.SystemRoot_sysnativedrivers_stbw_k64.sys
call fcn.004280cc
add esp, 0xc
jmp 0x427045
push 0x200
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004280cc
add esp, 0xc
lea edi, [ebp - 0x424]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x200]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x21c], 0
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x214], eax
jle 0x427180
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
movsx eax, byte [ebp + eax - 0x1f7]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x21c]
mov byte [ebp + eax - 0x1f7], 0
push str.system32_
mov eax, dword [ebp - 0x21c]
lea eax, [ebp + eax - 0x200]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x427168
mov eax, str.sysnative_
mov ecx, dword [ebp - 0x21c]
lea ecx, [ebp + ecx - 0x200]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov dx, word [eax + 8]
mov word [ecx + 8], dx
mov al, byte [eax + 0xa]
mov byte [ecx + 0xa], al
mov eax, dword [ebp - 0x21c]
lea edi, [ebp + eax - 0x41b]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x214], 0
jmp 0x42717b
mov al, byte [ebp - 0x20c]
mov ecx, dword [ebp - 0x21c]
mov byte [ebp + ecx - 0x1f7], al
jmp 0x427094
jmp 0x4271da
push str.system32drivers_stbw_k32.sys
lea eax, [ebp - 0x424]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x4271bf
push 0x200
lea eax, [ebp - 0x424]
push eax
push str.SystemRoot_system32drivers_stbw_k32.sys
call fcn.004280cc
add esp, 0xc
jmp 0x4271da
push 0x200
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004280cc
add esp, 0xc
cmp dword [ebp - 0x428], 0
je 0x427248
movsx eax, byte [ebp - 0x200]
test eax, eax
je 0x427248
movsx eax, byte [ebp - 0x1ff]
cmp eax, 0x3f
jne 0x427227
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x1fc]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
jmp 0x427243
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
jmp 0x427295
movsx eax, byte [ebp - 0x423]
cmp eax, 0x3f
jne 0x427279
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
jmp 0x427295
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00452b10
add esp, 8
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x424]
push eax
push str._nSYS_ImagePath___s_
call fcn.00452380
add esp, 8
cmp dword [ebp - 0x218], 0
je 0x4272f3
push 0x4744bc
call fcn.004535b0
add esp, 4
mov eax, 0x4744dc
mov ecx, 0x4744e0
xor edx, edx
cmp dword [ebp - 0x428], 0
setne dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
push str._n_rThe_file_STBW_K_s.SYS_must_be_present_for_the_Local_Agent_to_Audit_Website_Visits.
call fcn.00452380
add esp, 8
jmp 0x427324
mov eax, dword [ebp - 0x438]
push eax
push 0x47453c
call fcn.00452380
add esp, 8
lea eax, [ebp - 0x430]
push eax
call fcn.00453370
add esp, 4
push eax
push 0x474554
call fcn.00452380
add esp, 8
jmp 0x427344
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x424]
push eax
push str._nSYS_ImagePath___s___d_
call fcn.00452380
add esp, 0xc
mov eax, dword [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x208]
jmp 0x42735c
pop edi
pop esi
pop ebx
leave
ret