Function at 0x4710a0
Capabilities:
Act as tcp client
Check os version
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Get installed programs
Query or enumerate registry value
Resolve dns
Resolve function by parsing pe exports
Send data
Send data on socket
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x617db8
mov eax, dword fs:[0]
push eax
sub esp, 0x92c
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x928], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x940]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x948], 0
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x27], 0
call fcn.0040b8d0
mov byte [esp + 0x948], 1
lea ebp, [esi + 0x30]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x24]
lea edi, [esp + 0x34]
call fcn.0040ddb0
mov esi, dword [esi + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
or ebp, 0xffffffff
mov dword [esp + 0x74], edi
cmp edi, ebp
jne 0x471187
cmp dword [0x71038c], 3
jl 0x47115c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.socket_error____i
push str.Reporter::SendReport
push 3
call fcn.00579a92
add esp, 0x10
mov byte [esp + 0x948], 0
lea ecx, [esp + 0x34]
call fcn.0040ba40
mov dword [esp + 0x948], ebp
lea ecx, [esp + 0x950]
call fcn.0040ba40
xor al, al
jmp 0x472898
mov ecx, 2
push esi
mov word [esp + 0x130], cx
call dword [sym.imp.WS2_32.dll_htons]
push ecx
mov word [esp + 0x132], ax
mov edx, esp
mov dword [esp + 0x3c], esp
lea eax, [esp + 0x38]
push eax
push edx
call fcn.0040b930
mov byte [esp + 0x94c], 2
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0x950], 1
call fcn.00405b60
add esp, 8
mov ebx, 3
mov byte [esp + 0x948], bl
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x130], eax
mov byte [esp + 0x948], 1
lea ecx, [esp + 0x24]
call fcn.0040b810
cmp dword [esp + 0x130], ebp
jne 0x4712a8
push ecx
mov edx, esp
mov dword [esp + 0x3c], esp
lea eax, [esp + 0x38]
push eax
push edx
call fcn.0040b930
mov byte [esp + 0x94c], 4
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0x950], 1
call fcn.00405b60
add esp, 8
mov byte [esp + 0x948], 5
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
mov byte [esp + 0x948], 1
lea ecx, [esp + 0x24]
call fcn.0040b810
test esi, esi
jne 0x47128d
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [0x71038c], ebx
jl 0x47115c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.gethostbyname_error____i
push str.Reporter::SendReport
push ebx
jmp 0x471154
movsx edx, word [esi + 0xa]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push edx
push ecx
lea edx, [esp + 0x138]
push edx
call fcn.005c9060
add esp, 0xc
push 0x10
lea eax, [esp + 0x130]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, ebp
jne 0x4712c9
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x47115c
push 0x6d2548
lea ecx, [esp + 0x954]
push ecx
call fcn.004300f0
mov edx, dword [0x72a9e8]
push edx
lea eax, [esp + 0x954]
push eax
call fcn.004300f0
push 0x100000
call fcn.005c40dd
add esp, 4
push 0x100000
mov ebx, eax
push 0
push ebx
call fcn.005c8fb0
add esp, 8
mov ecx, esp
mov dword [esp + 0x3c], esp
lea edx, [esp + 0x954]
push edx
push ecx
call fcn.0040b930
mov byte [esp + 0x94c], 6
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x950], 1
call fcn.00405b60
add esp, 8
mov byte [esp + 0x948], 7
mov ecx, dword [eax]
mov edx, ebx
jmp 0x471350
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x471350
mov byte [esp + 0x948], 1
lea ecx, [esp + 0x24]
call fcn.0040b810
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x471370
sub eax, edx
xor edi, edi
mov esi, eax
xor ebp, ebp
mov edx, dword [esp + 0x74]
push 0
push esi
lea ecx, [edi + ebx]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x4713ad
mov byte [esp + 0x23], 1
cmp eax, 0xffffffff
je 0x4713ad
add edi, eax
cmp eax, esi
je 0x4713ad
inc ebp
sub esi, eax
cmp ebp, 0xa
jl 0x47137f
push ebx
call fcn.005c4000
add esp, 4
test edi, edi
je 0x472833
cmp byte [esp + 0x954], 0
je 0x472833
mov ebx, dword [esp + 0x74]
lea eax, [esp + 0x30]
push eax
call fcn.00470d70
mov byte [esp + 0x948], 8
mov edi, 1
cmp dword [0x71038c], edi
jl 0x471463
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
lea edx, [esp + 0x34]
push edx
push ecx
call fcn.0040b930
mov byte [esp + 0x94c], 9
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x950], 8
call fcn.00405b60
add esp, 8
mov esi, eax
mov byte [esp + 0x948], 0xa
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], edi
jle 0x47143c
mov ecx, dword [eax + 4]
push ecx
push esi
call fcn.0040dd10
mov esi, dword [esi]
push esi
push str.Receive_data:__s
push str.Reporter::SendReport
push edi
call fcn.00579a92
add esp, 0x10
mov byte [esp + 0x948], 8
lea ecx, [esp + 0x24]
call fcn.0040b810
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx - 0xc]
test eax, eax
jle 0x472822
push str.set_keywords:
push ecx
call fcn.005c476a
add esp, 8
test eax, eax
je 0x471490
sub eax, dword [esp + 0x30]
sar eax, 1
je 0x472822
lea edx, [esp + 0xe4]
push edx
call fcn.00443eb0
mov byte [esp + 0x948], 0xb
mov eax, dword [esp + 0x30]
cmp dword [eax - 4], edi
jle 0x4714c0
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.0040de10
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x94]
call fcn.0040b3c0
mov byte [esp + 0x948], 0xc
lea edx, [esp + 0x94]
push edx
mov esi, 0x3b
lea edi, [esp + 0xe8]
call fcn.00435b70
add esp, 4
mov byte [esp + 0x948], 0xb
lea esi, [esp + 0x94]
call fcn.0044df60
mov ecx, dword [esp + 0xf4]
sub ecx, dword [esp + 0xf0]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
xor ebp, ebp
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x68], ebp
je 0x47280d
cmp ebp, eax
jb 0x47153a
call fcn.005c475a
mov ecx, dword [esp + 0xf0]
lea eax, [ebp*8]
sub eax, ebp
cmp dword [ecx + eax*4 + 0x18], 8
lea eax, [ecx + eax*4]
jb 0x471559
mov eax, dword [eax + 4]
jmp 0x47155c
add eax, 4
lea edx, [esp + 0x18]
push edx
mov ecx, eax
call fcn.0040b990
mov byte [esp + 0x948], 0xd
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4727b7
jl 0x4715f9
push str.Quick_Scan
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x4715f9
sub eax, ecx
sar eax, 1
jne 0x4715f9
call fcn.00497e50
push 0
push 0
push 1
push ecx
mov esi, eax
mov eax, esp
mov dword [esp + 0x2c], esp
push eax
mov ecx, 0x6d3650
call fcn.00418b00
mov byte [esp + 0x958], 0xe
push esi
mov byte [esp + 0x95c], 0xd
call fcn.004a3bb0
push eax
mov ecx, esi
call fcn.004ae480
push 0
push 0
mov esi, eax
push esi
push 0x4a07b0
push 0
push 0
call fcn.005c4af6
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x30]
add esp, 0x18
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.Full_Scan
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x47167b
sub eax, ecx
sar eax, 1
jne 0x47167b
call fcn.00497e50
push 0
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push ecx
mov ecx, 0x6d366c
mov esi, eax
call fcn.00418b00
mov byte [esp + 0x958], 0xf
push esi
mov byte [esp + 0x95c], 0xd
call fcn.004a3bb0
push eax
mov ecx, esi
call fcn.004ae480
push 0
push 0
mov esi, eax
push esi
push 0x4a07b0
push 0
push 0
call fcn.005c4af6
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x30]
add esp, 0x18
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.Custom_Scan
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x47175f
sub eax, ecx
sar eax, 1
jne 0x47175f
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.0040b930
mov byte [esp + 0x948], 0x10
mov eax, dword [esp + 0x44]
cmp dword [eax - 0xc], 0
jge 0x4716cf
or eax, 0xffffffff
jmp 0x4716ec
push 0x6d0be0
push eax
call fcn.005c476a
add esp, 8
test eax, eax
jne 0x4716e6
or eax, 0xffffffff
jmp 0x4716ec
sub eax, dword [esp + 0x44]
sar eax, 1
inc eax
lea ebx, [esp + 0x44]
call fcn.00430070
call fcn.00497e50
push 0
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
mov edx, ebx
push edx
push ecx
mov esi, eax
call fcn.0040b930
mov byte [esp + 0x958], 0x11
push esi
mov byte [esp + 0x95c], 0x10
call fcn.004a3bb0
push eax
mov ecx, esi
call fcn.004ae480
push 0
push 0
mov esi, eax
push esi
push 0x4a07b0
push 0
push 0
call fcn.005c4af6
add esp, 0x18
mov dword [esi + 0xc], eax
mov byte [esp + 0x948], 0xd
mov ecx, ebx
call fcn.0040ba40
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.Device_Allow
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x4717a5
sub eax, ecx
sar eax, 1
jne 0x4717a5
call fcn.00497e50
xor cl, cl
call fcn.004a8d70
mov eax, dword [0x72a300]
add eax, 0xc0
push eax
call fcn.004bb7b0
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.Device_Block
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x4717ed
sub eax, ecx
sar eax, 1
jne 0x4717ed
call fcn.00497e50
mov cl, 1
call fcn.004a8d70
mov ecx, dword [0x72a300]
add ecx, 0xc0
push ecx
call fcn.004bb7b0
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.fw_enable
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.fw_disable
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.ssl_enable
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.ssl_disable
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.USB_Protection:
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x471e8a
sub eax, ecx
sar eax, 1
jne 0x471e8a
lea edx, [esp + 0xfc]
push edx
call fcn.00443eb0
mov byte [esp + 0x948], 0x12
or eax, 0xffffffff
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.0040b930
mov byte [esp + 0x948], 0x13
lea edx, [esp + 0xcc]
push edx
call fcn.00443eb0
mov bl, 0x14
mov byte [esp + 0x948], bl
mov eax, dword [esp + 0x4c]
cmp dword [eax - 4], 1
jle 0x4718f8
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.0040de10
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x94]
call fcn.0040b3c0
mov byte [esp + 0x948], 0x15
lea edx, [esp + 0x94]
push edx
mov esi, 0xd
lea edi, [esp + 0xd0]
call fcn.00435b70
add esp, 4
mov byte [esp + 0x948], bl
cmp dword [esp + 0xac], 8
jb 0x471949
mov eax, dword [esp + 0x98]
push eax
call fcn.005c396f
add esp, 4
mov esi, dword [esp + 0xd8]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0xa8], eax
mov dword [esp + 0x6c], eax
mov word [esp + 0x98], cx
mov ecx, dword [esp + 0xdc]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xac], 7
je 0x471de1
mov dword [esp + 0x2c], 0
cmp dword [esp + 0x6c], eax
jb 0x4719ae
call fcn.005c475a
mov esi, dword [esp + 0xd8]
mov eax, dword [esp + 0x2c]
cmp dword [esi + eax + 0x18], 8
jb 0x4719bf
mov ecx, dword [esi + eax + 4]
jmp 0x4719c3
lea ecx, [esi + eax + 4]
lea edx, [esp + 0x40]
push edx
call fcn.0040b990
mov byte [esp + 0x948], 0x16
lea ebx, [esp + 0x40]
call fcn.004458e0
mov ebx, eax
call fcn.00445960
lea eax, [esp + 0x50]
push eax
call fcn.00443eb0
mov byte [esp + 0x948], 0x17
mov eax, dword [esp + 0x40]
cmp dword [eax - 4], 1
jle 0x471a13
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.0040de10
mov eax, dword [esp + 0x40]
xor ebx, ebx
xor ecx, ecx
mov word [esp + 0xb4], cx
mov ebp, 7
mov ecx, eax
mov dword [esp + 0xc8], ebp
mov dword [esp + 0xc4], ebx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x471a37
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xb4]
call fcn.0040d7f0
mov byte [esp + 0x948], 0x18
mov edx, esi
push edx
mov esi, 0x3a
lea edi, [esp + 0x54]
call fcn.00435b70
add esp, 4
mov byte [esp + 0x948], 0x17
cmp dword [esp + 0xc8], 8
jb 0x471a91
mov eax, dword [esp + 0xb4]
push eax
call fcn.005c396f
add esp, 4
mov esi, dword [esp + 0x60]
xor ecx, ecx
mov word [esp + 0xb4], cx
mov ecx, dword [esp + 0x5c]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xc8], ebp
mov dword [esp + 0xc4], ebx
cmp eax, 2
jne 0x471d4f
lea edi, [eax + 0xc]
mov eax, dword [ecx + 0x14]
push str.USB_Protection
call fcn.0040dbd0
test eax, eax
jne 0x471b3c
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 1
ja 0x471b0e
call fcn.005c475a
mov esi, dword [esp + 0x5c]
mov ebp, 8
cmp dword [esi + 0x34], ebp
jb 0x471b2a
mov esi, dword [esi + 0x20]
push esi
call fcn.005c3ff5
add esp, 4
mov dword [esp + 0x28], eax
jmp 0x471b41
add esi, 0x20
push esi
call fcn.005c3ff5
add esp, 4
mov dword [esp + 0x28], eax
jmp 0x471b41
mov ebp, 8
mov esi, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x471b69
call fcn.005c475a
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + 0x14]
push str.delay
mov edi, 5
call fcn.0040dbd0
test eax, eax
jne 0x471bc4
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 1
ja 0x471baa
call fcn.005c475a
mov esi, dword [esp + 0x5c]
cmp dword [esi + 0x34], ebp
jb 0x471bb4
mov esi, dword [esi + 0x20]
jmp 0x471bb7
add esi, 0x20
push esi
call fcn.005c3ff5
add esp, 4
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x471bec
call fcn.005c475a
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + 0x14]
push str.password
mov edi, ebp
call fcn.0040dbd0
mov esi, dword [esp + 0x60]
mov ebx, dword [esp + 0x5c]
test eax, eax
jne 0x471c3c
mov ecx, esi
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 1
ja 0x471c30
call fcn.005c475a
mov esi, dword [esp + 0x60]
mov ebx, dword [esp + 0x5c]
lea eax, [ebx + 0x1c]
call fcn.00471060
mov dword [esp + 0x70], eax
sub esi, ebx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x471c5c
call fcn.005c475a
mov ebx, dword [esp + 0x5c]
mov eax, dword [ebx + 0x14]
push str.excluded
mov edi, ebp
mov ecx, ebx
call fcn.0040dbd0
test eax, eax
jne 0x471d4f
lea ecx, [esp + 0x80]
push ecx
mov ecx, 0x6cb38c
call fcn.0040b990
mov byte [esp + 0x948], 0x19
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
ja 0x471cba
call fcn.005c475a
mov esi, dword [esp + 0x5c]
cmp dword [esi + 0x34], ebp
jb 0x471cc4
mov ecx, dword [esi + 0x20]
jmp 0x471cc7
lea ecx, [esi + 0x20]
lea edx, [esp + 0x8c]
push edx
call fcn.0040b990
mov bl, 0x1a
mov byte [esp + 0x948], bl
lea eax, [esp + 0x80]
push eax
push 0x2c
lea edx, [esp + 0x94]
lea ecx, [esp + 0x11c]
call fcn.004c1630
add esp, 8
mov byte [esp + 0x948], 0x1b
push eax
lea ecx, [esp + 0x100]
push ecx
call fcn.00475990
mov byte [esp + 0x948], bl
lea edx, [esp + 0x114]
push edx
call fcn.00424990
mov byte [esp + 0x948], 0x19
lea ecx, [esp + 0x8c]
call fcn.0040ba40
mov byte [esp + 0x948], 0x17
lea ecx, [esp + 0x80]
call fcn.0040ba40
mov byte [esp + 0x948], 0x16
lea eax, [esp + 0x50]
push eax
call fcn.00475fe0
mov byte [esp + 0x948], 0x14
lea ecx, [esp + 0x40]
call fcn.0040ba40
mov ecx, dword [esp + 0xdc]
mov esi, dword [esp + 0xd8]
mov edi, dword [esp + 0x6c]
add dword [esp + 0x2c], 0x1c
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
mov dword [esp + 0x6c], edi
cmp edi, eax
jb 0x47199c
mov esi, dword [esp + 0x70]
cmp esi, 0xffffffff
je 0x471dbf
call fcn.00497e50
push eax
call fcn.004aad80
mov edi, dword [esp + 0x28]
cmp edi, 0xffffffff
je 0x471de1
mov esi, dword [esp + 0x1c]
cmp esi, 0xffffffff
je 0x471de1
call fcn.00497e50
push esi
push edi
push 1
mov edi, eax
call fcn.004aa580
call fcn.00497e50
mov edi, eax
mov eax, dword [esp + 0x10c]
sub eax, dword [esp + 0x108]
xor esi, esi
sar eax, 2
test eax, eax
jbe 0x471e30
cmp esi, eax
jb 0x471e08
call fcn.005c475a
mov ecx, dword [esp + 0x108]
lea edx, [ecx + esi*4]
push edx
mov ecx, edi
call fcn.004aa840
mov eax, dword [esp + 0x10c]
sub eax, dword [esp + 0x108]
inc esi
sar eax, 2
cmp esi, eax
jb 0x471e08
mov byte [esp + 0x948], 0x13
lea eax, [esp + 0xcc]
push eax
call fcn.00475fe0
mov byte [esp + 0x948], 0x12
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471e6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x948], 0xd
lea ecx, [esp + 0xfc]
push ecx
call fcn.00424990
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x68]
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.Exclude_drive:
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x471f5b
sub eax, ecx
sar eax, 1
jne 0x471f5b
lea eax, [ecx - 0x10]
call fcn.0040fb70
add eax, 0x10
mov dword [esp + 0x3c], eax
mov byte [esp + 0x948], 0x1e
mov eax, dword [esp + 0x3c]
cmp dword [eax - 0xc], 0
jge 0x471ede
or eax, 0xffffffff
jmp 0x471efb
push 0x6d0be0
push eax
call fcn.005c476a
add esp, 8
test eax, eax
jne 0x471ef5
or eax, 0xffffffff
jmp 0x471efb
sub eax, dword [esp + 0x3c]
sar eax, 1
inc eax
lea ebx, [esp + 0x3c]
call fcn.00430070
mov eax, dword [esp + 0x3c]
push ecx
mov esi, esp
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x2c], esi
call fcn.0040fb70
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x94c], 0x20
mov byte [esp + 0x94c], 0x1e
call fcn.00434ff0
add esp, 4
mov esi, eax
call fcn.00497e50
push esi
mov edi, eax
call fcn.004aa700
mov byte [esp + 0x948], 0xd
mov ecx, ebx
call fcn.0040ba40
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.Unexclude_drive:
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x47202c
sub eax, ecx
sar eax, 1
jne 0x47202c
lea eax, [ecx - 0x10]
call fcn.0040fb70
add eax, 0x10
mov dword [esp + 0x48], eax
mov byte [esp + 0x948], 0x22
mov eax, dword [esp + 0x48]
cmp dword [eax - 0xc], 0
jge 0x471faf
or eax, 0xffffffff
jmp 0x471fcc
push 0x6d0be0
push eax
call fcn.005c476a
add esp, 8
test eax, eax
jne 0x471fc6
or eax, 0xffffffff
jmp 0x471fcc
sub eax, dword [esp + 0x48]
sar eax, 1
inc eax
lea ebx, [esp + 0x48]
call fcn.00430070
mov eax, dword [esp + 0x48]
push ecx
mov esi, esp
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x2c], esi
call fcn.0040fb70
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x94c], 0x24
mov byte [esp + 0x94c], 0x22
call fcn.00434ff0
add esp, 4
mov esi, eax
call fcn.00497e50
push esi
mov edi, eax
call fcn.004aab60
mov byte [esp + 0x948], 0xd
mov ecx, ebx
call fcn.0040ba40
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.opt_prot
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x472056
sub eax, ecx
sar eax, 1
je 0x4720f6
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.opt_scan
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x47207c
sub eax, ecx
sar eax, 1
je 0x4720f6
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.opt_update
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x4720a2
sub eax, ecx
sar eax, 1
je 0x4720f6
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.opt_sch
push ecx
call fcn.005c476a
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
je 0x4720c8
sub eax, ecx
sar eax, 1
je 0x4720f6
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.opt_logs
push ecx
call fcn.005c476a
add esp, 8
test eax, eax
je 0x472452
mov ecx, dword [esp + 0x18]
sub eax, ecx
sar eax, 1
jne 0x472456
lea eax, [ecx - 0x10]
call fcn.0040fb70
lea esi, [eax + 0x10]
mov dword [esp + 0x78], esi
mov byte [esp + 0x948], 0x26
cmp dword [esi - 0xc], 0
jge 0x472118
or eax, 0xffffffff
jmp 0x472133
push 0x6d0be0
push esi
call fcn.005c476a
add esp, 8
test eax, eax
jne 0x47212f
or eax, 0xffffffff
jmp 0x472133
sub eax, esi
sar eax, 1
inc eax
lea ebx, [esp + 0x78]
call fcn.00430070
mov ecx, ebx
call fcn.00405c80
mov ecx, dword [0x72a75c]
sub ecx, dword [0x72a758]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x47242a
mov ecx, dword [0x72a300]
add ecx, 0xc0
push ecx
call fcn.004bb680
call fcn.004021c0
mov ecx, dword [0x72a75c]
sub ecx, dword [0x72a758]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor ebp, ebp
add eax, edx
je 0x472403
mov dword [esp + 0x2c], ebp
cmp ebp, eax
jb 0x4721b4
call fcn.005c475a
mov eax, dword [esp + 0x2c]
mov edx, dword [0x72a758]
lea esi, [edx + eax]
mov eax, dword [esi]
test eax, eax
jne 0x4721de
movzx edx, byte [esi + 0xc]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
call fcn.00401cf0
jmp 0x4723d6
cmp eax, 1
jne 0x4721f9
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
call fcn.00401ad0
jmp 0x4723d6
cmp eax, 2
jne 0x472255
push ecx
mov ecx, dword [esi + 0x14]
lea eax, [esi + 0x14]
mov edi, esp
mov dword [esp + 0x20], esp
mov dword [edi], ecx
cmp eax, edi
jne 0x472228
push 0x2d6
push str.c:qt4.8.6includeqtcore.._.._src_corelib_tools_qstring.h
push str.other___this
call fcn.004f8ad0
add esp, 0xc
mov edx, dword [edi]
mov eax, 1
lock xadd dword [edx], eax
mov byte [esp + 0x94c], 0x27
mov eax, dword [esi + 8]
mov esi, dword [esi + 4]
push eax
push esi
mov byte [esp + 0x954], 0x26
call fcn.00401f20
jmp 0x4723d6
cmp eax, 3
jne 0x4723d6
mov eax, dword [esi + 4]
push str.Realtime
push eax
call fcn.005c5322
add esp, 8
test eax, eax
sete al
test al, al
je 0x472376
mov eax, dword [esi + 8]
lea edi, [esi + 8]
push str.RealtimeNew
push eax
call fcn.005c5322
add esp, 8
test eax, eax
sete al
test al, al
je 0x472376
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
call fcn.00401130
mov byte [esp + 0x94c], 0x28
push ecx
mov dword [esp + 0x30], esp
mov ebx, esp
push 0xffffffffffffffff
push str.RealtimeNew
call fcn.00502e60
add esp, 8
mov dword [ebx], eax
mov byte [esp + 0x950], 0x29
push str.Realtime
lea ecx, [esp + 0x88]
push ecx
mov byte [esp + 0x958], 0x26
call fcn.00401560
mov byte [esp + 0x948], 0x2a
lea edx, [esi + 0x18]
push edx
lea ecx, [esp + 0x80]
call fcn.00476260
push ecx
lea eax, [esp + 0x80]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00401190
mov byte [esp + 0x94c], 0x2b
mov eax, dword [edi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x472334
mov ecx, dword [eax + 4]
push ecx
push edi
call fcn.0040dd10
mov edi, dword [edi]
push ecx
mov dword [esp + 0x30], esp
mov ebx, esp
push 0xffffffffffffffff
push edi
call fcn.00502e60
add esp, 8
mov dword [ebx], eax
mov byte [esp + 0x950], 0x2c
mov esi, dword [esi + 4]
push esi
mov byte [esp + 0x954], 0x2a
call fcn.004018a0
mov byte [esp + 0x948], 0x26
lea ecx, [esp + 0x7c]
call fcn.00401200
jmp 0x4723d6
push ecx
lea edx, [esi + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.00401190
mov byte [esp + 0x94c], 0x2d
mov eax, dword [esi + 8]
lea edi, [esi + 8]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x4723a7
mov eax, dword [eax + 4]
push eax
push edi
call fcn.0040dd10
mov edi, dword [edi]
push ecx
mov dword [esp + 0x30], esp
mov ebx, esp
push 0xffffffffffffffff
push edi
call fcn.00502e60
add esp, 8
mov dword [ebx], eax
mov byte [esp + 0x950], 0x2e
mov esi, dword [esi + 4]
push esi
mov byte [esp + 0x954], 0x26
call fcn.004018a0
mov ecx, dword [0x72a75c]
sub ecx, dword [0x72a758]
add dword [esp + 0x2c], 0x1c
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebp
add eax, edx
cmp ebp, eax
jb 0x4721b4
call fcn.004021c0
mov ecx, dword [0x72a300]
add ecx, 0xc0
push ecx
call fcn.004bb680
call fcn.00497e50
mov ecx, eax
call fcn.004a4660
mov ebp, dword [esp + 0x68]
mov byte [esp + 0x948], 0xd
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x472452
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.opt_pass
push ecx
call fcn.005c476a
add esp, 8
test eax, eax
je 0x4725af
mov ecx, dword [esp + 0x18]
sub eax, ecx
sar eax, 1
jne 0x4725b3
lea eax, [ecx - 0x10]
call fcn.0040fb70
lea esi, [eax + 0x10]
mov dword [esp + 0x84], esi
mov byte [esp + 0x948], 0x31
cmp dword [esi - 0xc], 0
jge 0x4724a9
or eax, 0xffffffff
jmp 0x4724c4
push 0x6d0be0
push esi
call fcn.005c476a
add esp, 8
test eax, eax
jne 0x4724c0
or eax, 0xffffffff
jmp 0x4724c4
sub eax, esi
sar eax, 1
inc eax
lea ebx, [esp + 0x84]
call fcn.00430070
mov ecx, dword [0x72a300]
add ecx, 0xc0
push ecx
call fcn.004bb680
call fcn.004021c0
push 1
push str.Locked
push str.Main
call fcn.00401cf0
mov esi, dword [esp + 0x84]
push esi
call fcn.005c3ff5
add esp, 4
push eax
push str.Password
push str.Main
mov dword [esp + 0x44], eax
call fcn.00401ad0
mov edx, dword [0x72a524]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x472574
lea eax, [esp + 0x88]
push eax
push 2
mov dword [esp + 0x90], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov eax, dword [esp + 0x88]
test eax, eax
je 0x47256e
push 4
lea ecx, [esp + 0x3c]
push ecx
push 4
push str.SP01
push str.SoftwareMicrosoftShared
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
call fcn.004021c0
mov edx, dword [0x72a300]
add edx, 0xc0
push edx
call fcn.004bb680
mov byte [esp + 0x948], 0xd
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4725af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.Download_Updates
push ecx
call fcn.005c476a
add esp, 8
test eax, eax
je 0x472633
mov ecx, dword [esp + 0x18]
sub eax, ecx
sar eax, 1
jne 0x472637
call fcn.00497e50
push 8
mov edi, eax
call fcn.005c39f5
add esp, 4
test eax, eax
je 0x4725f9
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov esi, eax
jmp 0x4725fb
xor esi, esi
mov dword [esi], edi
mov byte [esi + 4], 0
mov ecx, dword [edi + 0x144]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x472633
push 0
push 0
push esi
push 0x4ad820
push 0
push 0
call fcn.005c4af6
add esp, 0x18
mov dword [edi + 0x144], eax
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jl 0x4727b7
push str.Uninstall_Client
push ecx
call fcn.005c476a
add esp, 8
test eax, eax
je 0x4727b7
sub eax, dword [esp + 0x18]
sar eax, 1
jne 0x4727b7
cmp dword [0x72a524], 0
je 0x47279a
mov edx, dword [0x728f58]
mov eax, dword [edx + 0xc]
mov ecx, 0x728f58
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
mov byte [esp + 0x948], 0x34
mov ecx, dword [0x72a524]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x140]
push eax
push 0
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallVibranium_Advanced_Security_is1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0xa8], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x472716
mov ecx, dword [esp + 0x90]
shr ecx, 1
xor edx, edx
lea eax, [esp + 0x13c]
mov word [esp + ecx*2 + 0x13c], dx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4726f0
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x13c]
mov ebx, eax
push ecx
lea eax, [esp + 0x28]
call fcn.0040fac0
mov esi, dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [esi - 0xc], 0
je 0x472774
mov edi, dword [0x72a524]
push ecx
mov edx, esp
mov dword [esp + 0x20], esp
push edx
mov ecx, str._VERYSILENT
call fcn.0040b990
mov byte [esp + 0x94c], 0x35
push ecx
mov ebx, esp
lea eax, [esi - 0x10]
mov dword [esp + 0x30], esp
mov dword [esp + 0x78], ebx
call fcn.0040fb70
add eax, 0x10
mov dword [ebx], eax
mov byte [esp + 0x950], 0x37
mov byte [esp + 0x950], 0x34
mov ecx, edi
call fcn.00470e70
add esp, 8
mov byte [esp + 0x948], 0xd
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4727b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4727b7
cmp dword [0x71038c], 3
jl 0x4727b7
push str.User_token_is_not_available
push str.Reporter::SendReport
push 3
call fcn.00579a92
add esp, 0xc
mov byte [esp + 0x948], 0xb
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4727df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xf4]
sub ecx, dword [esp + 0xf0]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebp
add eax, edx
mov dword [esp + 0x68], ebp
cmp ebp, eax
jb 0x47153a
mov byte [esp + 0x948], 8
lea ecx, [esp + 0xe4]
push ecx
call fcn.00475fe0
mov byte [esp + 0x948], 1
lea ecx, [esp + 0x30]
call fcn.0040ba40
mov edx, dword [esp + 0x74]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov byte [esp + 0x948], 0
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472866
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x948], 0xffffffff
mov eax, dword [esp + 0x950]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472894
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [esp + 0x23]
mov ecx, dword [esp + 0x940]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x928]
xor ecx, esp
call fcn.005c397a
add esp, 0x938
ret 8