Function at 0x4753c0
Capabilities:
Create thread
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670aa8
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x3eb0
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x3eb4], ebx
mov byte [ebp - 0x120], 0
push 0x103
push 0
lea eax, [ebp - 0x11f]
push eax
call fcn.005dfd60
mov byte [ebp - 0x224], 0
push 0x103
push 0
lea ecx, [ebp - 0x223]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x42c], 0
push 0x103
push 0
lea edx, [ebp - 0x42b]
push edx
call fcn.005dfd60
mov dword [ebp - 0x3eb8], 0
mov byte [ebp - 0x2150], 0
push 0xfff
push 0
lea eax, [ebp - 0x214f]
push eax
call fcn.005dfd60
mov ecx, 0xd2
mov esi, str._REGISTRYUSERCSIDSoftwareMicrosoftCommand_Processor__REGISTRYUSERCSIDSoftwareMicrosoftInternet_ExplorerMain__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__REGISTRYUSERCSIDSoftwareMicrosoftWindows_NTCurrentVersionWinlogon__REGISTRYUSERCSIDSoftwareMicrosoftWindows_NTCurrentVersionWindows__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionRun__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionRunOnce__REGISTRYUSERCSIDSoftwareVSRevoGroupRevoUninstallerGeneral__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionInternet_Settings__REGISTRYUSERCSIDControl_PanelDesktop
lea edi, [ebp - 0x3d60]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xcb7
push 0
lea ecx, [ebp - 0x3a17]
push ecx
call fcn.005dfd60
add esp, 0x3c
mov dword [ebp - 4], 0
push 0x6e8e18
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x6861d8
push str.ProtectProxySettings
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4754ee
mov edx, dword [0x6861d8]
push edx
push str.ProtectProxySettings
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x6861d8], 1
jne 0x475549
mov byte [ebp - 0xb48], 0
push 0x103
push 0
lea eax, [ebp - 0xb47]
push eax
call fcn.005dfd60
push 0
push 0x104
lea ecx, [ebp - 0xb48]
push ecx
push 0x60c81c
push str.ProtectProxySettingsCustom
push 0x60c810
call fcn.004efe40
add esp, 0x24
cmp byte [ebp - 0xb48], 0x30
jne 0x475549
mov dword [0x6861d8], 0
cmp byte [ebp - 0x3d60], 0
je 0x476cd6
lea edx, [ebp - 0x3ec8]
push edx
push 1
xor edi, edi
push edi
push ebx
push reloc.WS2_32.dll_closesocket
call fcn.004dc0a0
add esp, 0x14
mov esi, eax
push 0x103
push edi
cmp esi, edi
jne 0x476c78
mov byte [ebp - 0x328], 0
lea eax, [ebp - 0x327]
push eax
call fcn.005dfd60
mov esi, 0x104
mov dword [ebp - 0x3ea8], esi
mov byte [ebp - 0x83c], 0
push 0x103
push edi
lea ecx, [ebp - 0x83b]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x2d60], 0
push 0x3ff
push edi
lea edx, [ebp - 0x2d5f]
push edx
call fcn.005dfd60
mov byte [ebp - 0x1150], 0
push 0x3ff
push edi
lea eax, [ebp - 0x114f]
push eax
call fcn.005dfd60
add esp, 0x30
mov dword [ebp - 0x3eb0], edi
mov dword [ebp - 0x3ea4], edi
mov ecx, dword [ebp - 0x3ec8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x3ea4]
push edx
push 0x6aec98
push edi
call fcn.004629e0
add esp, 0xc
cmp dword [0x6b079c], edi
je 0x475638
lea eax, [ebp - 0x3ea4]
push eax
push 0x6aec98
push 1
call fcn.004629e0
add esp, 0xc
lea ecx, [ebp - 0x3ea4]
push ecx
push 0x6aec98
push edi
push ebx
call fcn.00462cb0
add esp, 0x10
cmp dword [0x6b079c], edi
je 0x47566d
lea edx, [ebp - 0x3ea4]
push edx
push 0x6aec98
push 1
push ebx
call fcn.00462cb0
add esp, 0x10
cmp dword [ebp - 0x3ea4], edi
je 0x4756e7
push str.powershell.exe_msiexec.exe_wmic.exe
call fcn.0050c680
lea eax, [ebp - 0x3ea4]
push eax
push 0x6aec98
push edi
call fcn.004629e0
add esp, 0x10
cmp dword [0x6b079c], edi
je 0x4756b2
lea ecx, [ebp - 0x3ea4]
push ecx
push 0x6aec98
push 1
call fcn.004629e0
add esp, 0xc
lea edx, [ebp - 0x3ea4]
push edx
push 0x6aec98
push edi
push ebx
call fcn.00462cb0
add esp, 0x10
cmp dword [0x6b079c], edi
je 0x4756e7
lea eax, [ebp - 0x3ea4]
push eax
push 0x6aec98
push 1
push ebx
call fcn.00462cb0
add esp, 0x10
push ebx
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x83c]
push ecx
call fcn.005dfb23
add esp, 0xc
lea edx, [ebp - 0x3ea8]
push edx
lea eax, [ebp - 0x328]
push eax
push 0x631eb0
lea ecx, [ebp - 0x83c]
push ecx
push reloc.WS2_32.dll_closesocket
call fcn.004d5770
cmp byte [ebp - 0x328], 0
jne 0x47576b
lea edx, [ebp - 0x328]
push edx
push 2
call fcn.00461800
add esp, 8
cmp dword [0x71de6c], edi
je 0x4757a6
lea eax, [ebp - 0x328]
push eax
push str.CSIDL_PROGRAMS_B____s
lea ecx, [ebp - 0x2150]
push ecx
call fcn.005dfb23
push edi
mov edx, dword [0x71de6c]
push edx
lea eax, [ebp - 0x2150]
push eax
jmp 0x475799
cmp dword [0x71de6c], edi
je 0x4757a6
lea ecx, [ebp - 0x328]
push ecx
push str.CSIDL_PROGRAMS_A____s
lea edx, [ebp - 0x2150]
push edx
call fcn.005dfb23
push edi
mov eax, dword [0x71de6c]
push eax
lea ecx, [ebp - 0x2150]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp byte [0x72d250], 0
je 0x47583a
push edi
push 0x631e70
lea edx, [ebp - 0x328]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x47583a
push 0x72d250
push 0x631e68
lea eax, [ebp - 0x3e64]
push eax
call fcn.005dfb23
lea ecx, [ebp - 0x3e64]
push ecx
push 0x631e70
lea edx, [ebp - 0x328]
push edx
call fcn.004e9030
add esp, 0x18
cmp dword [0x71de6c], edi
je 0x47583a
lea eax, [ebp - 0x328]
push eax
push str.CSIDL_PROGRAMS_C____s
lea ecx, [ebp - 0x2150]
push ecx
call fcn.005dfb23
push edi
mov edx, dword [0x71de6c]
push edx
lea eax, [ebp - 0x2150]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0x3ea8], esi
lea ecx, [ebp - 0x3ea8]
push ecx
lea edx, [ebp - 0x120]
push edx
push 0x631e40
lea eax, [ebp - 0x83c]
push eax
push reloc.WS2_32.dll_closesocket
call fcn.004d5770
cmp byte [ebp - 0x120], 0
je 0x4758c5
lea ecx, [ebp - 0x120]
push ecx
call fcn.004ec720
add esp, 4
test eax, eax
je 0x4758c5
cmp dword [0x71de6c], edi
je 0x4759a9
lea edx, [ebp - 0x120]
push edx
push str.CSIDL_DESKTOPDIRECTORY_A____s
lea eax, [ebp - 0x2150]
push eax
call fcn.005dfb23
push edi
mov ecx, dword [0x71de6c]
push ecx
lea edx, [ebp - 0x2150]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x4759a9
lea eax, [ebp - 0x120]
push eax
push 0x10
call fcn.00461800
add esp, 8
cmp byte [ebp - 0x120], 0
je 0x4759a9
lea ecx, [ebp - 0x120]
push ecx
call fcn.004ec720
add esp, 4
test eax, eax
je 0x4759a9
cmp dword [0x71de6c], edi
je 0x475936
lea edx, [ebp - 0x120]
push edx
push str.CSIDL_DESKTOPDIRECTORY_B____s
lea eax, [ebp - 0x2150]
push eax
call fcn.005dfb23
push edi
mov ecx, dword [0x71de6c]
push ecx
lea edx, [ebp - 0x2150]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
lea eax, [ebp - 0x120]
push eax
call fcn.004e24e0
add esp, 4
call fcn.004d9b00
test eax, eax
je 0x47598b
lea eax, [ebp - 0x120]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x475955
mov ecx, dword [str...AppDataLocal]
mov dword [eax], ecx
mov edx, dword [0x631df0]
mov dword [eax + 4], edx
mov ecx, dword [0x631df4]
mov dword [eax + 8], ecx
mov edx, dword [0x631df8]
mov dword [eax + 0xc], edx
mov cl, byte [0x631dfc]
mov byte [eax + 0x10], cl
jmp 0x4759a9
lea edi, [ebp - 0x120]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x475992
mov ecx, 8
mov esi, str...Local_SettingsApplication_Data
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [0x72d250], 0
je 0x475a40
push 0
push 0x631e70
lea edx, [ebp - 0x120]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x475a40
push 0x72d250
push 0x631e68
lea eax, [ebp - 0x3e64]
push eax
call fcn.005dfb23
lea ecx, [ebp - 0x3e64]
push ecx
push 0x631e70
lea edx, [ebp - 0x120]
push edx
call fcn.004e9030
add esp, 0x18
cmp dword [0x71de6c], 0
je 0x475a40
lea eax, [ebp - 0x120]
push eax
push str.CSIDL_DESKTOPDIRECTORY_C____s
lea ecx, [ebp - 0x2150]
push ecx
call fcn.005dfb23
push 0
mov edx, dword [0x71de6c]
push edx
lea eax, [ebp - 0x2150]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp byte [ebp - 0x120], 0
je 0x475e2c
mov byte [ebp - 0x2550], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x254f]
push ecx
call fcn.005dfd60
push 0
lea edx, [ebp - 0x2550]
push edx
lea eax, [ebp - 0x120]
push eax
call fcn.005cc4f0
add esp, 0x18
cmp byte [ebp - 0x2550], 0
jne 0x475aa2
mov ecx, dword [str.Default]
mov dword [ebp - 0x2550], ecx
mov edx, dword [0x631da4]
mov dword [ebp - 0x254c], edx
jmp 0x475aba
push 0x2c
lea eax, [ebp - 0x2550]
push eax
call fcn.005e0940
add esp, 8
test eax, eax
je 0x475aba
mov byte [eax], 0
lea ecx, [ebp - 0x120]
push ecx
call fcn.004e24e0
add esp, 4
lea ecx, [ebp - 0x120]
mov edx, 0x72ff90
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x475ad4
lea ecx, [ebp - 0x120]
mov edx, 0x730098
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x475af0
lea ecx, [ebp - 0x120]
mov edx, 0x72fd80
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x475b05
lea ecx, [ebp - 0x120]
mov edx, 0x72fe88
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x475b20
mov edi, 0x72fd80
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x475b30
mov ecx, 9
mov esi, str.MicrosoftInternet_ExplorerDOMStore_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x72fe88
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x475b50
mov ecx, 0x17
mov esi, str.PackagesMicrosoft.MicrosoftEdge_8wekyb3d8bbweAC_001MicrosoftEdgeUserDefaultDOMStore_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x72fd80
call fcn.004ec720
add esp, 4
test eax, eax
je 0x475ba4
push 0x72fd80
push str.IExplore_DOM_Folder:__s
lea edx, [ebp - 0x2150]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x2150]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 0x72fe88
call fcn.004ec720
add esp, 4
test eax, eax
je 0x475be3
push 0x72fe88
push str.Edge_DOM_Folder:__s
lea ecx, [ebp - 0x2150]
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x2150]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov edi, 0x72ff90
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x475bf0
mov ecx, 6
mov esi, str.GoogleChromeUser_Data_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x2550]
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x475c10
sub eax, ecx
mov esi, ecx
mov edi, 0x72ff90
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x475c21
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 0x72ff90
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x475c40
mov ecx, dword [str.Cache]
mov dword [eax], ecx
mov dx, word [0x631ccc]
mov word [eax + 4], dx
mov cl, byte [0x631cce]
mov byte [eax + 6], cl
lea edi, [ebp - 0x120]
dec edi
jmp 0x475c70
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x475c70
mov ecx, 6
mov esi, str.GoogleChromeUser_Data_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x2550]
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x475c90
sub eax, ecx
mov esi, ecx
lea edi, [ebp - 0x120]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x475ca2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x120]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x475cc0
mov edx, dword [str.Extensions]
mov dword [eax], edx
mov ecx, dword [0x62c898]
mov dword [eax + 4], ecx
mov edx, dword [0x62c89c]
mov dword [eax + 8], edx
mov edi, 0x730098
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x475ce8
mov ecx, 6
mov esi, str.GoogleChromeUser_Data_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x2550]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x475d05
sub eax, ecx
mov esi, ecx
mov edi, 0x730098
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x475d16
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x120]
push eax
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x475d69
push 0x60c81c
lea ecx, [ebp - 0x120]
push ecx
call fcn.004e92a0
lea edx, [ebp - 0x120]
push edx
call fcn.004ec720
add esp, 0xc
test eax, eax
jne 0x475d69
mov byte [ebp - 0x120], al
push 0x72ff90
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x475d9f
push 0x60c81c
push 0x72ff90
call fcn.004e92a0
push 0x72ff90
call fcn.004ec720
add esp, 0xc
test eax, eax
jne 0x475d9f
mov byte [0x72ff90], al
cmp byte [ebp - 0x120], 0
je 0x475e2c
lea ecx, [ebp - 0x120]
mov edx, 0x7301a0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x475db7
push 0x7301a0
call fcn.004e2520
mov eax, dword [0x7302cc]
push eax
push 0x7301a0
push str.Chrome_Extensions_Folder:__s__DIA_u_
lea ecx, [ebp - 0x2150]
push ecx
call fcn.005dfb23
xor esi, esi
push esi
push 1
lea edx, [ebp - 0x2150]
push edx
push 0x6aec98
call fcn.004311c0
push 0x72ff90
push str.Chrome_Cache_Folder:__s
lea eax, [ebp - 0x2150]
push eax
call fcn.005dfb23
push esi
push 1
lea ecx, [ebp - 0x2150]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x40
jmp 0x475e56
push str.Unable_to_get_Extensions_folder_for_Chrome_
lea edx, [ebp - 0x2150]
push edx
call fcn.005dfb23
xor esi, esi
push esi
push 1
lea eax, [ebp - 0x2150]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x18
mov eax, dword [0x72c278]
cmp eax, esi
je 0x475e6e
push eax
call fcn.005e0865
add esp, 4
mov dword [0x72c278], esi
mov eax, dword [0x72c27c]
cmp eax, esi
je 0x475e86
push eax
call fcn.005e0865
add esp, 4
mov dword [0x72c27c], esi
mov eax, dword [0x72c280]
cmp eax, esi
je 0x475e9e
push eax
call fcn.005e0865
add esp, 4
mov dword [0x72c280], esi
mov edi, 0x104
mov dword [ebp - 0x3ea8], edi
lea ecx, [ebp - 0x3ea8]
push ecx
lea edx, [ebp - 0x224]
push edx
push 0x631c54
lea eax, [ebp - 0x83c]
push eax
push reloc.WS2_32.dll_closesocket
call fcn.004d5770
cmp byte [ebp - 0x224], 0
je 0x475eed
lea ecx, [ebp - 0x224]
push ecx
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x475fb7
lea edx, [ebp - 0x224]
push edx
push 0x10
call fcn.00461800
add esp, 8
cmp byte [ebp - 0x224], 0
je 0x475fb7
lea eax, [ebp - 0x224]
push eax
call fcn.004ec720
add esp, 4
test eax, eax
je 0x475fb7
lea ecx, [ebp - 0x224]
push ecx
call fcn.004e24e0
add esp, 4
call fcn.004d9b00
test eax, eax
lea eax, [ebp - 0x224]
je 0x475f82
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x475f41
mov edx, dword [str...AppDataRoaming]
mov dword [eax], edx
mov ecx, dword [0x631c44]
mov dword [eax + 4], ecx
mov edx, dword [0x631c48]
mov dword [eax + 8], edx
mov ecx, dword [0x631c4c]
mov dword [eax + 0xc], ecx
mov dx, word [0x631c50]
mov word [eax + 0x10], dx
mov cl, byte [0x631c52]
mov byte [eax + 0x12], cl
jmp 0x475fb7
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x475f83
mov edx, dword [str...Application_Data]
mov dword [eax], edx
mov ecx, dword [0x631c30]
mov dword [eax + 4], ecx
mov edx, dword [0x631c34]
mov dword [eax + 8], edx
mov ecx, dword [0x631c38]
mov dword [eax + 0xc], ecx
mov edx, dword [0x631c3c]
mov dword [eax + 0x10], edx
cmp byte [0x72d250], 0
je 0x47600b
push esi
push 0x631e70
lea eax, [ebp - 0x224]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x47600b
push 0x72d250
push 0x631e68
lea ecx, [ebp - 0x3e64]
push ecx
call fcn.005dfb23
lea edx, [ebp - 0x3e64]
push edx
push 0x631e70
lea eax, [ebp - 0x224]
push eax
call fcn.004e9030
add esp, 0x18
cmp dword [0x71de6c], esi
je 0x476046
lea ecx, [ebp - 0x224]
push ecx
push str.AppDataRoaming___s
lea edx, [ebp - 0x2150]
push edx
call fcn.005dfb23
push esi
mov eax, dword [0x71de6c]
push eax
lea ecx, [ebp - 0x2150]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov dword [ebp - 0x3ea8], edi
lea edx, [ebp - 0x3ea8]
push edx
lea eax, [ebp - 0x42c]
push eax
push 0x631e40
lea ecx, [ebp - 0x83c]
push ecx
push reloc.WS2_32.dll_closesocket
call fcn.004d5770
cmp byte [ebp - 0x42c], 0
je 0x476090
lea edx, [ebp - 0x42c]
push edx
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x476137
lea eax, [ebp - 0x42c]
push eax
push 0x10
call fcn.00461800
add esp, 8
cmp byte [ebp - 0x42c], 0
je 0x476137
lea ecx, [ebp - 0x42c]
push ecx
call fcn.004ec720
add esp, 4
test eax, eax
je 0x476137
lea edx, [ebp - 0x42c]
push edx
call fcn.004e24e0
add esp, 4
call fcn.004d9b00
test eax, eax
je 0x476116
lea eax, [ebp - 0x42c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4760e0
mov ecx, dword [str...AppDataLocal]
mov dword [eax], ecx
mov edx, dword [0x631df0]
mov dword [eax + 4], edx
mov ecx, dword [0x631df4]
mov dword [eax + 8], ecx
mov edx, dword [0x631df8]
mov dword [eax + 0xc], edx
mov cl, byte [0x631dfc]
mov byte [eax + 0x10], cl
jmp 0x476137
lea edi, [ebp - 0x42c]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x476120
mov ecx, 8
mov esi, str...Local_SettingsApplication_Data
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [0x72d250], 0
je 0x47618c
push 0
push 0x631e70
lea edx, [ebp - 0x42c]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x47618c
push 0x72d250
push 0x631e68
lea eax, [ebp - 0x3e64]
push eax
call fcn.005dfb23
lea ecx, [ebp - 0x3e64]
push ecx
push 0x631e70
lea edx, [ebp - 0x42c]
push edx
call fcn.004e9030
add esp, 0x18
cmp dword [0x71de6c], 0
je 0x4761ca
lea eax, [ebp - 0x42c]
push eax
push str.AppDataLocalFF___s
lea ecx, [ebp - 0x2150]
push ecx
call fcn.005dfb23
push 0
mov edx, dword [0x71de6c]
push edx
lea eax, [ebp - 0x2150]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp byte [ebp - 0x224], 0
je 0x47657d
lea ecx, [ebp - 0x42c]
push ecx
call fcn.004e24e0
add esp, 4
lea edi, [ebp - 0x42c]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4761f0
mov ecx, 6
mov esi, str.MozillaFirefoxProfiles
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x224]
push edx
call fcn.004e24e0
add esp, 4
lea edi, [ebp - 0x224]
dec edi
jmp 0x476220
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x476220
mov ecx, 6
mov esi, str.MozillaFirefoxProfiles
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [0x71de6c], 0
je 0x4762a4
lea eax, [ebp - 0x224]
push eax
push str.AppDataRoaming_A____s
lea ecx, [ebp - 0x2150]
push ecx
call fcn.005dfb23
push 0
mov edx, dword [0x71de6c]
push edx
lea eax, [ebp - 0x2150]
push eax
push 0x6aec98
call fcn.004311c0
lea ecx, [ebp - 0x42c]
push ecx
push str.AppDataLocalFF_A____s
lea edx, [ebp - 0x2150]
push edx
call fcn.005dfb23
push 0
mov eax, dword [0x71de6c]
push eax
lea ecx, [ebp - 0x2150]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x38
lea edx, [ebp - 0x224]
push edx
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x4762ea
push 0x60c81c
lea eax, [ebp - 0x224]
push eax
call fcn.004e92a0
lea ecx, [ebp - 0x224]
push ecx
call fcn.004ec720
add esp, 0xc
test eax, eax
jne 0x47657d
mov byte [ebp - 0x224], al
jmp 0x47657d
lea ecx, [ebp - 0x224]
lea edx, [ebp - 0x530]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4762f6
lea edx, [ebp - 0x530]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x530]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x476316
mov ecx, dword [str..default]
mov dword [eax], ecx
mov edx, dword [0x631bb0]
mov dword [eax + 4], edx
mov cx, word [0x631bb4]
mov word [eax + 8], cx
mov dl, byte [0x631bb6]
mov byte [eax + 0xa], dl
mov esi, 1
lea eax, [ebp - 0x3ea0]
push eax
lea ecx, [ebp - 0x530]
push ecx
call fcn.004e0820
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 8
cmp ebx, 0xffffffff
je 0x47657d
test esi, esi
je 0x476571
test byte [ebp - 0x3ea0], 0x10
je 0x47655d
mov byte [ebp - 0xd50], 0
mov byte [ebp - 0x738], 0
push 0x207
push 0
lea edx, [ebp - 0x737]
push edx
call fcn.005dfd60
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x530]
push ecx
call edi
lea edx, [ebp - 0x530]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x3e74]
push eax
lea ecx, [ebp - 0x530]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
lea ecx, [ebp - 0x530]
lea edx, [ebp - 0xd50]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4763f0
lea edx, [ebp - 0x530]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x530]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x476410
mov ecx, dword [str.extensions]
mov dword [eax], ecx
mov edx, dword [0x631ba4]
mov dword [eax + 4], edx
mov cx, word [0x631ba8]
mov word [eax + 8], cx
mov dl, byte [0x631baa]
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x530]
push eax
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x47647a
push 0x60c81c
lea ecx, [ebp - 0x530]
push ecx
call fcn.004e92a0
lea edx, [ebp - 0x530]
push edx
call fcn.004ec720
add esp, 0xc
test eax, eax
jne 0x47647a
mov byte [ebp - 0x530], al
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x738]
push ecx
call edi
lea edx, [ebp - 0x738]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x3e74]
push eax
lea ecx, [ebp - 0x738]
push ecx
call esi
lea edx, [ebp - 0x738]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [ebp - 0x738]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4764c0
mov ecx, dword [str.cache2]
mov dword [eax], ecx
mov dx, word [0x631b9c]
mov word [eax + 4], dx
mov cl, byte [0x631b9e]
mov byte [eax + 6], cl
lea edx, [ebp - 0x738]
push edx
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x476521
push 0x60c81c
lea eax, [ebp - 0x738]
push eax
call fcn.004e92a0
lea ecx, [ebp - 0x738]
push ecx
call fcn.004ec720
add esp, 0xc
test eax, eax
jne 0x476521
mov byte [ebp - 0x738], al
cmp byte [ebp - 0x530], 0
je 0x47653f
push 0
push 0x2c
lea edx, [ebp - 0x530]
push edx
push 0x72c27c
call fcn.004e5820
cmp byte [ebp - 0x738], 0
je 0x47655d
push 0
push 0x2c
lea eax, [ebp - 0x738]
push eax
push 0x72c280
call fcn.004e5820
lea ecx, [ebp - 0x3ea0]
push ecx
push ebx
call fcn.004d5ad0
mov esi, eax
jmp 0x476363
cmp ebx, 0xffffffff
je 0x47657d
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x72c27c]
xor ebx, ebx
cmp eax, ebx
je 0x476644
cmp byte [eax], bl
je 0x476644
push eax
push str.Firefox_Extensions_Folder_s_:__s
lea edx, [ebp - 0x2150]
push edx
call fcn.005dfb23
push ebx
push 1
lea eax, [ebp - 0x2150]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov eax, dword [0x72c27c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4765c5
sub eax, edx
add eax, 0x20
push eax
call fcn.004d9470
add esp, 4
mov dword [0x72c278], eax
cmp eax, ebx
je 0x4765fa
mov ecx, dword [0x72c27c]
mov edx, eax
jmp 0x4765f0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4765f0
mov eax, dword [0x72c280]
cmp eax, ebx
je 0x476631
cmp byte [eax], 0
je 0x476631
push eax
push str.Firefox_Cache_Folder_s_:__s
lea ecx, [ebp - 0x2150]
push ecx
call fcn.005dfb23
push ebx
push 1
lea edx, [ebp - 0x2150]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 7
push ebx
mov eax, dword [0x7302e0]
push eax
call fcn.0044bee0
add esp, 0xc
jmp 0x47666c
push str.Unable_to_get_Extensions_folder_for_Firefox_
lea ecx, [ebp - 0x2150]
push ecx
call fcn.005dfb23
push ebx
push 1
lea edx, [ebp - 0x2150]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
cmp dword [0x72dd7c], ebx
je 0x4766d2
push ebx
push ebx
push 0x4747e0
call fcn.005e07ac
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x4766bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_1wclb__fails_with_error__d
lea eax, [ebp - 0x3e64]
push eax
call fcn.005dfb23
push ebx
push 1
lea ecx, [ebp - 0x3e64]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x4766d2
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push esi
push str.CBD_CLBR4a
call fcn.00420720
add esp, 0xc
mov dword [ebp - 0x3ec0], ebx
lea edx, [ebp - 0x3ec0]
push edx
push 0x61726c
push str.SOFTWAREMicroWorldContentFilteringSchedule
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x3ec0], ebx
je 0x476704
push ebx
call fcn.00460ba0
add esp, 4
cmp byte [ebp - 0x120], 0
je 0x476721
push ebx
push 0x2c
lea eax, [ebp - 0x120]
push eax
push 0x72c27c
call fcn.004e5820
cmp byte [ebp - 0x328], 0
je 0x476898
mov dword [ebp - 0x3ebc], ebx
lea ecx, [ebp - 0x328]
push ecx
call fcn.004e24e0
add esp, 4
push str.Startup
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x328]
push eax
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x47683e
lea ecx, [ebp - 0x328]
push ecx
push str.CurrentUser_Startup_Folder_Absent_A_:___s_
lea edx, [ebp - 0xd50]
push edx
call fcn.005dfb23
push ebx
push 1
lea eax, [ebp - 0xd50]
push eax
push 0x6aec98
call fcn.004311c0
push 0x5c
lea ecx, [ebp - 0x328]
push ecx
call fcn.005e0940
add esp, 0x24
cmp eax, ebx
je 0x476898
push 0x5c
inc eax
push eax
call fcn.005e0940
add esp, 8
cmp eax, ebx
je 0x476898
push 0x5c
inc eax
push eax
call fcn.005e0940
add esp, 8
cmp eax, ebx
je 0x476898
inc eax
mov byte [eax], 0
lea edi, [ebp - 0x328]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4767e4
mov ecx, 0xf
mov esi, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebp - 0x328]
push edx
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x47683e
lea eax, [ebp - 0x328]
push eax
push str.CurrentUser_Startup_Folder_Absent_B_:___s_
lea ecx, [ebp - 0x738]
push ecx
call fcn.005dfb23
push ebx
push 1
lea edx, [ebp - 0x738]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x476898
mov dword [ebp - 0x3ebc], 1
lea eax, [ebp - 0x328]
push eax
push str.CurrentUser_Startup:___s_
lea ecx, [ebp - 0xd50]
push ecx
call fcn.005dfb23
push ebx
push 1
lea edx, [ebp - 0xd50]
push edx
push 0x6aec98
call fcn.004311c0
lea eax, [ebp - 0x328]
push eax
call fcn.004e24e0
add esp, 0x20
push 1
push 0x2c
lea ecx, [ebp - 0x328]
push ecx
push 0x72c01c
call fcn.004e5820
cmp dword [0x71de6c], ebx
je 0x4768f0
mov eax, dword [0x72c01c]
cmp eax, ebx
je 0x4768c0
push eax
push str.FoldersToBeMonitoredForSuspiciousFiles_B_:__s
lea edx, [ebp - 0x2150]
push edx
call fcn.005dfb23
add esp, 0xc
jmp 0x4768d4
push str.FoldersToBeMonitoredForSuspiciousFiles_B_:_NULL
lea eax, [ebp - 0x2150]
push eax
call fcn.005dfb23
add esp, 8
push ebx
mov ecx, dword [0x71de6c]
push ecx
lea edx, [ebp - 0x2150]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [ebp - 0x3eb4]
push eax
push str.REGISTRYUSER_s
lea ecx, [ebp - 0x2d60]
push ecx
call fcn.005dfb23
lea edx, [ebp - 0x2d60]
push edx
push str.REGISTRYUSERCSID
lea eax, [ebp - 0x3d60]
push eax
call fcn.004e9030
push 1
push 0
push 0x2c
lea ecx, [ebp - 0x3eb0]
push ecx
lea edx, [ebp - 0x1150]
push edx
lea eax, [ebp - 0x3d60]
push eax
call fcn.004e1380
add esp, 0x30
mov ebx, dword [ebp + 0xc]
jmp 0x476950
cmp dword [ebp - 0x3eb0], 0xffffffff
je 0x476cd6
mov byte [ebp - 0x2960], 0
push 0x40f
xor edi, edi
push edi
lea ecx, [ebp - 0x295f]
push ecx
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x3eac], edi
mov esi, 1
mov dword [ebp - 0x3ec4], esi
lea edx, [ebp - 0x2960]
cmp byte [ebp - 0x1150], 0x21
jne 0x4769ad
lea ecx, [ebp - 0x114f]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4769a1
jmp 0x4769bd
lea ecx, [ebp - 0x1150]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4769b3
lea edx, [ebp - 0x2960]
push edx
call fcn.004e24e0
add esp, 4
cmp dword [0x6861d8], edi
jne 0x4769f9
push edi
push str.Internet_Settings
lea eax, [ebp - 0x2960]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4769f9
mov dword [ebp - 0x3ec4], edi
jmp 0x476c50
cmp esi, edi
je 0x476c50
lea ecx, [ebp - 0x3eac]
push ecx
lea edx, [ebp - 0x2960]
push edx
call fcn.004e33e0
add esp, 8
cmp eax, 1
jne 0x476c50
mov edi, dword [ebp - 0x3eac]
mov eax, edi
lea edx, [eax + 2]
jmp 0x476a30
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x476a30
sub eax, edx
sar eax, 1
lea esi, [eax + eax]
cmp ebx, 1
jne 0x476b5e
push 0
push str.Internet_Settings
lea eax, [ebp - 0x1150]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x476a6c
mov dword [ebp - 0x3eb8], ebx
cmp byte [ebp - 0x1150], 0x21
jne 0x476a86
mov ecx, dword [ebp - 0x3eac]
push ecx
push esi
push 0
push 0x2000206
jmp 0x476a95
mov edx, dword [ebp - 0x3eac]
push edx
push esi
push 0
push 0x2000209
call dword [0x6e9120]
mov esi, eax
add esp, 0x10
cmp dword [0x71de6c], 0
je 0x476c33
test esi, esi
jl 0x476aeb
lea eax, [ebp - 0x1150]
push eax
push str.Successfully_Added_to_REGMON:__s
lea ecx, [ebp - 0x2150]
push ecx
call fcn.005dfb23
push 0
mov edx, dword [0x71de6c]
push edx
lea eax, [ebp - 0x2150]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x476c33
mov byte [ebp - 0xa44], 0
push 0x103
push 0
lea ecx, [ebp - 0xa43]
push ecx
call fcn.005dfd60
lea edx, [ebp - 0xa44]
push edx
push esi
call fcn.0044c900
add esp, 0x14
lea eax, [ebp - 0x1150]
lea ecx, [ebp - 0x2150]
cmp byte [ebp - 0xa44], 0
jne 0x476b33
push esi
push eax
push str.___Failed_To_add_to_REGMON___s_._Reason:_0x_x
jmp 0x476b40
lea edx, [ebp - 0xa44]
push edx
push eax
push str.___Failed_To_add_to_REGMON___s_._Reason:__s
push ecx
call fcn.005dfb23
add esp, 0x10
push 0
mov edx, dword [0x71de6c]
push edx
lea eax, [ebp - 0x2150]
push eax
jmp 0x476c26
push edi
push esi
push 0
push 0x2000207
call dword [0x6e9120]
add esp, 0x10
mov esi, eax
cmp dword [0x71de6c], 0
je 0x476c33
test esi, esi
jl 0x476bb9
lea ecx, [ebp - 0x1150]
push ecx
push str.Successfully_Removed_from_REGMON:__s
lea edx, [ebp - 0x2150]
push edx
call fcn.005dfb23
push 0
mov eax, dword [0x71de6c]
push eax
lea ecx, [ebp - 0x2150]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x476c33
mov byte [ebp - 0x940], 0
push 0x103
push 0
lea edx, [ebp - 0x93f]
push edx
call fcn.005dfd60
lea eax, [ebp - 0x940]
push eax
push esi
call fcn.0044c900
add esp, 0x14
lea ecx, [ebp - 0x1150]
lea edx, [ebp - 0x2150]
cmp byte [ebp - 0x940], 0
jne 0x476c01
push esi
push ecx
push str.___Failed_To_Remove_from_REGMON___s_._Reason:_0x_x
jmp 0x476c0e
lea eax, [ebp - 0x940]
push eax
push ecx
push str.___Failed_To_Remove_from_REGMON___s_._Reason:__s
push edx
call fcn.005dfb23
add esp, 0x10
push 0
mov eax, dword [0x71de6c]
push eax
lea ecx, [ebp - 0x2150]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [ebp - 0x3eac]
test eax, eax
je 0x476c50
push eax
call fcn.005e0865
add esp, 4
mov dword [ebp - 0x3eac], 0
push 1
push 0
push 0x2c
lea edx, [ebp - 0x3eb0]
push edx
lea eax, [ebp - 0x1150]
push eax
lea ecx, [ebp - 0x3d60]
push ecx
call fcn.004e1380
add esp, 0x18
jmp 0x476950
mov byte [ebp - 0x3e64], 0
lea edx, [ebp - 0x3e63]
push edx
call fcn.005dfd60
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x104
lea eax, [ebp - 0x3e64]
push eax
call fcn.004d8c20
lea ecx, [ebp - 0x3e64]
push ecx
push ebx
push str.Unable_to_open_HKEY_USERS_s__Reason:__s
lea edx, [ebp - 0xd50]
push edx
call fcn.005dfb23
push edi
push 1
lea eax, [ebp - 0xd50]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x28
cmp dword [ebp - 0x3eb8], 0
je 0x476cf8
push 1
mov esi, dword [ebp - 0x3eb4]
push esi
call fcn.00473c90
push 1
push esi
call fcn.00473ea0
add esp, 0x10
cmp dword [0x7302cc], 1
jne 0x476d27
mov eax, dword [0x72c27c]
test eax, eax
je 0x476da9
cmp byte [eax], 0
je 0x476da9
push 0
push eax
call fcn.00464450
add esp, 8
jmp 0x476da9
cmp byte [0x7301a0], 0
je 0x476da9
push 0
push 0
push 0x4753a0
call fcn.005e07ac
add esp, 0xc
cmp eax, 0xffffffff
jne 0x476d78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_1wCH__fails_with_error__d
lea ecx, [ebp - 0x3e64]
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x3e64]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x476da9
push 0
push eax
push str.CBD_4Chr
call fcn.00420720
add esp, 0xc
jmp 0x476da9
push 0x6e8e18
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret