Function at 0x4df490
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x650c03
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x755898]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
lea ecx, [esi + 8]
mov dword [esi], vtable.CIDMSpider.0
call fcn.005e5090
xor ebx, ebx
mov dword [esp + 0x28], ebx
lea ecx, [esi + 0x150]
call fcn.00435330
mov byte [esp + 0x28], 1
lea ecx, [esi + 0x178]
call fcn.0051b330
mov byte [esp + 0x28], 2
lea ecx, [esi + 0x190]
call fcn.00427310
mov byte [esp + 0x28], 3
lea ecx, [esi + 0x1a8]
call fcn.00536fe0
mov byte [esp + 0x28], 4
lea ecx, [esi + 0x2f8]
call fcn.00421910
mov byte [esp + 0x28], 5
lea ecx, [esi + 0x398]
call fcn.0050f210
mov byte [esp + 0x28], 6
lea ecx, [esi + 0x3d4]
call fcn.004cc760
mov byte [esp + 0x28], 7
lea ecx, [esi + 0x3e4]
call fcn.004cc520
mov byte [esp + 0x28], 8
xor eax, eax
mov dword [esi + 0x41c], ebx
mov dword [esi + 0x424], ebx
mov word [esi + 0x420], ax
mov byte [esp + 0x28], 9
lea ecx, [esi + 0x428]
call fcn.00402500
mov byte [esp + 0x28], 0xa
lea ecx, [esi + 0x42c]
call fcn.00402500
mov byte [esp + 0x28], 0xb
lea ecx, [esi + 0x430]
call fcn.00402500
mov byte [esp + 0x28], 0xc
lea ecx, [esi + 0x434]
call fcn.00402500
mov byte [esp + 0x28], 0xd
lea ecx, [esi + 0x43c]
call fcn.00402500
mov byte [esp + 0x28], 0xe
lea ecx, [esi + 0x440]
call fcn.00402500
mov byte [esp + 0x28], 0xf
lea ecx, [esi + 0x448]
call fcn.00402500
mov byte [esp + 0x28], 0x10
lea ecx, [esi + 0x44c]
call fcn.00402500
mov byte [esp + 0x28], 0x11
mov dword [esi + 0x454], ebx
mov dword [esi + 0x458], ebx
mov dword [esi + 0x45c], ebx
mov byte [esp + 0x28], 0x12
xor ecx, ecx
mov dword [esi + 0x460], ebx
mov dword [esi + 0x468], ebx
mov word [esi + 0x464], cx
mov byte [esp + 0x28], 0x13
lea ecx, [esi + 0x46c]
call fcn.00402500
mov byte [esp + 0x28], 0x14
lea ecx, [esi + 0x474]
call fcn.00402500
mov byte [esp + 0x28], 0x15
push 0xa
lea ecx, [esi + 0x490]
call fcn.004cd050
mov byte [esp + 0x28], 0x16
lea ecx, [esi + 0x4b4]
call fcn.00402500
mov byte [esp + 0x28], 0x17
lea ecx, [esi + 0x4b8]
call fcn.00402500
mov byte [esp + 0x28], 0x18
xor edx, edx
mov dword [esi + 0x4c0], ebx
mov dword [esi + 0x4c8], ebx
mov word [esi + 0x4c4], dx
mov byte [esp + 0x28], 0x19
lea ecx, [esi + 0x4f0]
call fcn.00402500
mov byte [esp + 0x28], 0x1a
lea ecx, [esi + 0x514]
call fcn.004cd090
mov byte [esp + 0x28], 0x1b
lea ecx, [esi + 0x528]
call fcn.004cd0d0
mov byte [esp + 0x28], 0x1c
mov byte [esi + 0x4ad], bl
mov byte [esi + 0x4ae], bl
mov byte [esi + 0x4af], bl
mov byte [esi + 0x4ac], bl
mov dword [esi + 0x4bc], ebx
mov dword [esi + 0x48c], ebx
mov byte [esi + 0x479], bl
mov dword [esi + 0x4f4], 1
mov dword [esi + 0x4f8], ebx
mov byte [esi + 0x438], bl
mov byte [esi + 0x444], bl
mov byte [esi + 0x450], bl
mov byte [esi + 0x4cd], 1
mov byte [esi + 0x540], bl
mov dword [esi + 0x4d0], ebx
mov dword [esi + 0x4d4], ebx
mov dword [esi + 0x4d8], ebx
mov dword [esi + 0x4dc], ebx
mov dword [esi + 0x4e0], ebx
mov dword [esi + 0x4e4], ebx
mov dword [esi + 0x4e8], ebx
mov dword [esi + 0x4ec], ebx
mov byte [esi + 0x47b], bl
mov byte [esi + 0x3f4], bl
mov byte [esi + 0x3f5], bl
mov dword [esi + 0x50c], ebx
mov dword [esi + 0x510], ebx
mov dword [esi + 0x53c], ebx
mov dword [esi + 0x508], 1
mov byte [esi + 0x47a], bl
mov byte [esi + 0x4cc], bl
mov byte [esi + 0x504], bl
mov dword [esi + 0x4fc], ebx
mov dword [esi + 0x500], ebx
mov dword [esi + 0x47c], ebx
mov dword [esi + 0x480], ebx
lea eax, [esi + 0x3f8]
push eax
mov byte [esi + 0x486], bl
mov byte [esi + 0x484], bl
mov byte [esi + 0x485], bl
mov byte [esi + 0x487], bl
mov byte [esi + 0x488], bl
mov dword [esi + 0x410], ebx
mov dword [esi + 0x418], ebx
mov dword [esi + 0x544], ebx
mov dword [esi + 0x54c], ebx
mov dword [esi + 0x548], ebx
mov dword [esi + 0x550], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, esi
call fcn.004d74d0
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
call edi
test eax, eax
jne 0x4df83b
mov edx, dword [esp + 0x10]
push 4
push 0x68a7d0
push 1
push ebx
push str.Disable_Script_Debugger
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.SoftwareMicrosoftInternet_ExplorerInternational
push 0x80000001
mov dword [esi + 0x588], 1
call edi
test eax, eax
jne 0x4df8bb
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push str.W2KLpk
push ecx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x4df892
mov edx, dword [esp + 0x14]
mov dword [esi + 0x588], edx
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push ebx
push str.W2KLpk
push ecx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.004df300
mov dword [esp + 0x28], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret