Function at 0x42d160
Capabilities:
Check os version
Get common file path
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x2b0
push ebx
push ebp
push esi
push edi
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x230]
mov dword [esp + 0x22c], 0x94
rep stosd dword es:[edi], eax
lea eax, [esp + 0x22c]
xor ebx, ebx
xor ebp, ebp
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x23c]
mov ecx, 1
cmp eax, 2
jne 0x42d216
mov eax, dword [esp + 0x230]
cmp eax, 5
jne 0x42d1f5
mov eax, dword [esp + 0x234]
cmp eax, ecx
jne 0x42d1de
mov ebx, ecx
mov dword [esp + 0x24], ebx
jmp 0x42d216
cmp eax, ebx
jne 0x42d1e8
mov dword [esp + 0x1c], ecx
jmp 0x42d216
cmp eax, 2
jb 0x42d216
mov ebp, ecx
mov dword [esp + 0x18], ebp
jmp 0x42d216
cmp eax, 6
jne 0x42d216
mov eax, dword [esp + 0x234]
cmp eax, ebx
jne 0x42d20e
mov dword [esp + 0x128], ecx
jmp 0x42d216
cmp eax, ecx
jne 0x42d216
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1ac]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push esi
mov edi, eax
push str.SYSTEMCurrentControlSetServices_s
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
call fcn.0047a8f8
push 0x49d620
push esi
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x42d304
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
test edi, edi
jne 0x42d298
push str._SystemRoot__system32_alg.exe
call fcn.00483565
add esp, 4
jmp 0x42d2c7
lea edx, [esp + 0x1ac]
push str.alg.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.AppMgmt
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42d494
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x42d33c
cmp dword [esp + 0x18], 1
jne 0x42d3f1
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x42d387
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x42d3f1
push str._SystemRoot_System32_appmgmts.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ServiceDll
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
cmp dword [esp + 0x1c], 1
jne 0x431e56
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42d430
push str._SystemRoot__system32_services.exe
call fcn.00483565
add esp, 4
jmp 0x42d45f
lea ecx, [esp + 0x1ac]
push str.services.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.Alerter
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42d624
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x42d4cc
cmp dword [esp + 0x18], 1
jne 0x42d581
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42d517
push str._SystemRoot__system32_svchost.exe__k_LocalService
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42d581
push str._SystemRoot_System32_alrsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x1c], 1
jne 0x431e56
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42d5c0
push str._SystemRoot__system32_services.exe
call fcn.00483565
add esp, 4
jmp 0x42d5ef
lea eax, [esp + 0x1ac]
push str.services.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.AudioSrv
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42d7b4
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jne 0x42d709
lea edx, [esp + 0x10]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call ebx
test eax, eax
jne 0x42d69f
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x42d709
push str._SystemRoot_System32_audiosrv.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov ecx, dword [esp + 0x128]
mov eax, 1
cmp ecx, eax
je 0x42d723
cmp dword [esp + 0x20], eax
jne 0x431e56
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42d76e
push str._SystemRoot__system32_svchost.exe__k_LocalServiceNetworkRestricted
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_audiosrv.dll
jmp 0x4310a3
push str.bits
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42d989
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 1
jne 0x42d8a0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42d832
push str._SystemRoot__system32_svchost.exe__k_BITSgroup
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42d8a0
push str._SystemRoot_System32qmgr.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ServiceDll
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x42d8b8
cmp ebx, 1
je 0x42d8b8
cmp dword [esp + 0x20], 1
jne 0x431e56
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42d907
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
push str._SystemRoot_System32qmgr.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.Browser
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42db2a
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp ecx, eax
je 0x42d9c6
cmp ebx, eax
je 0x42d9c6
cmp dword [esp + 0x20], eax
jne 0x42da83
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42da15
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42da83
push str._SystemRoot_System32_browser.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x1c], 1
jne 0x431e56
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42dac6
push str._SystemRoot__system32_services.exe
call fcn.00483565
add esp, 4
jmp 0x42daf5
lea eax, [esp + 0x1ac]
push str.services.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.ClipSrv
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42dbd8
cmp ebx, 1
je 0x42db4e
cmp ebp, 1
jne 0x42dbd8
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
test edi, edi
jne 0x42db82
push str._SystemRoot__system32clipsrv.exe
call fcn.00483565
add esp, 4
jmp 0x42dbb1
lea ecx, [esp + 0x1ac]
push str.clipsrv.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x431e4b
push str.cisvc
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42dc9c
cmp ebx, 1
je 0x42dbfc
cmp ebp, 1
jne 0x42dc9c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
test edi, edi
jne 0x42dc30
push str._SystemRoot__system32cisvc.exe
call fcn.00483565
add esp, 4
jmp 0x42dc5f
lea edx, [esp + 0x1ac]
push str.cisvc.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.CryptSvc
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42de4e
cmp ebx, 1
je 0x42ddab
cmp ebp, 1
je 0x42ddab
mov edi, dword [esp + 0x20]
cmp edi, 1
jne 0x42de52
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x30]
push eax
push edx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42dd2d
push str._SystemRoot__system32_svchost.exe__k_NetworkService
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32cryptsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
push str.ServiceDll
mov eax, dword [esp + 0x24]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x10]
push edx
push 2
lea eax, [esp + 0x30]
push 0
push eax
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42de08
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32cryptsvc.dll
jmp 0x42d94c
mov edi, dword [esp + 0x20]
push 0x49d304
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42df15
cmp ebp, 1
jne 0x42df15
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42dea9
push str._SystemRoot__system32Dfssvc.exe
call fcn.00483565
add esp, 4
jmp 0x42ded8
lea edx, [esp + 0x1ac]
push str.Dfssvc.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.dhcp
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42e1ad
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 1
jne 0x42df91
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x42df91
push str._SystemRoot__system32_services.exe
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
cmp dword [esp + 0x18], 1
jne 0x42e051
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x42dfe7
push str._SystemRoot__system32_svchost.exe__k_NetworkService
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x42e051
push str._SystemRoot_System32dhcpcsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp dword [esp + 0x24], 1
jne 0x42e111
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42e0a7
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42e111
push str._SystemRoot_System32dhcpcsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x20], 1
jne 0x431e56
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x42e167
push str._SystemRoot__system32_svchost.exe__k_LocalServiceNetworkRestricted
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32dhcpcore.dll
jmp 0x42dd6e
push str.ERSvc
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42e333
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 1
jne 0x42e297
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x42e22d
push str._SystemRoot__system32_svchost.exe__k_WinErr
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x42e297
push str._SystemRoot_System32ersvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp dword [esp + 0x24], 1
jne 0x431e56
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42e2ed
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32ersvc.dll
jmp 0x4310a3
push str.EventSystem
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42e4a9
cmp ebx, 1
je 0x42e406
cmp ebp, 1
je 0x42e406
cmp edi, 1
jne 0x42e4a9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x30]
push eax
push edx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42e3c0
push str._SystemRoot__system32_svchost.exe__k_LocalService
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32es.dll
jmp 0x42dd6e
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x10]
push edx
push 2
lea eax, [esp + 0x30]
push 0
push eax
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42e463
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32es.dll
jmp 0x42d94c
push str.Eventlog
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42e571
cmp ebx, 1
je 0x42e4cd
cmp ebp, 1
jne 0x42e571
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42e505
push str._SystemRoot__system32_services.exe
call fcn.00483565
add esp, 4
jmp 0x42e534
lea edx, [esp + 0x1ac]
push str.services.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push 0x49d1f4
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42e6d6
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp ebx, 1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x42e5a9
cmp dword [esp + 0x18], 1
jne 0x42e62d
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebp
test eax, eax
jne 0x42e62d
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42e5d9
push str._SystemRoot__system32_fxssvc.exe
call fcn.00483565
add esp, 4
jmp 0x42e608
lea eax, [esp + 0x1ac]
push str.fxssvc.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov ecx, dword [esp + 0x20]
mov eax, 1
cmp ecx, eax
jne 0x431e6b
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebp
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42e672
push str._SystemRoot__system32_fxssvc.exe
call fcn.00483565
add esp, 4
jmp 0x42e6a1
lea ecx, [esp + 0x1ac]
push str.fxssvc.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.HidServ
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42e84d
cmp ebx, 1
je 0x42e7aa
cmp ebp, 1
je 0x42e7aa
cmp edi, 1
jne 0x42e84d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 2
lea ecx, [esp + 0x30]
push 0
push ecx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42e764
push str._SystemRoot__system32_svchost.exe__k_LocalSystemNetworkRestricted
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32hidserv.dll
jmp 0x4310a3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x30]
push 0
push edx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42e807
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32hidserv.dll
jmp 0x42dd6e
push str.IISADMIN
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42e8f9
cmp ebp, 1
jne 0x42e8f9
lea edx, [esp + 0x10]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42e8a3
push str._SystemRoot__system32inetsrvinetinfo.exe
call fcn.00483565
add esp, 4
jmp 0x42e8d2
lea ecx, [esp + 0x1ac]
push str.inetsrvinetinfo.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x431e4b
push str.IPRIP
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42e9bb
cmp ebp, 1
jne 0x42e9bb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 2
lea ecx, [esp + 0x30]
push 0
push ecx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42e975
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_svchostdll.dll
jmp 0x4310a3
push str.IsmServ
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42ea74
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42ea08
push str._SystemRoot__system32ismserv.exe
call fcn.00483565
add esp, 4
jmp 0x42ea37
lea eax, [esp + 0x1ac]
push str.ismserv.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.LicenseService
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42eb17
lea edx, [esp + 0x10]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42eac1
push str._SystemRoot__system32llssrv.exe
call fcn.00483565
add esp, 4
jmp 0x42eaf0
lea ecx, [esp + 0x1ac]
push str.llssrv.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x431e4b
push str.LmHosts
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42ed06
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 1
jne 0x42ec0c
cmp ebx, 1
jne 0x42ec0c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42eb9e
push str._SystemRoot__system32_svchost.exe__k_LocalService
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ec0c
push str._SystemRoot_System32lmhsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x1c], 1
jne 0x42ec62
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ec62
push str._SystemRoot__system32_services.exe
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
cmp dword [esp + 0x20], 1
jne 0x431e56
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ecbc
push str._SystemRoot__system32_svchost.exe__k_LocalServiceNetworkRestricted
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
push str._SystemRoot_System32lmhsvc.dll
jmp 0x42d94c
push str.MSDTC
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42edc0
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42ed54
push str._SystemRoot__system32msdtc.exe
call fcn.00483565
add esp, 4
jmp 0x42ed83
lea edx, [esp + 0x1ac]
push str.msdtc.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.MSFtpsvc
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42ee79
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42ee0d
push str._SystemRoot__system32inetsrvinetinfo.exe
call fcn.00483565
add esp, 4
jmp 0x42ee3c
lea eax, [esp + 0x1ac]
push str.inetsrvinetinfo.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.MSIServer
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42ef1c
lea edx, [esp + 0x10]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42eec6
push str._SystemRoot__system32msiexec.exe__V
call fcn.00483565
add esp, 4
jmp 0x42eef5
lea ecx, [esp + 0x1ac]
push str.msiexec.exe__V
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x431e4b
push str.Messenger
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42f096
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x42ef54
cmp dword [esp + 0x18], 1
jne 0x42f009
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42ef9f
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42f009
push str._SystemRoot_System32msgsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x1c], 1
jne 0x431e56
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42f04b
push str._SystemRoot__system32_services.exe
call fcn.00483565
add esp, 4
jmp 0x42f92c
lea eax, [esp + 0x1ac]
push str.services.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
push str.ImagePath
jmp 0x42dd8d
push 0x49cf78
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42f14e
lea edx, [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42f108
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32mswsock.dll
jmp 0x42d94c
push str.NtFrs
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42f208
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42f19c
push str._SystemRoot__system32_ntfrs.exe
call fcn.00483565
add esp, 4
jmp 0x42f1cb
lea edx, [esp + 0x1ac]
push str.ntfrs.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.NtmsSvc
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42f2c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x30]
push eax
push edx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42f27a
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_ntmssvc.dll
jmp 0x42dd6e
push str.PlugPlay
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42f437
cmp ebx, 1
je 0x42f393
cmp ebp, 1
je 0x42f393
cmp edi, 1
jne 0x42f437
lea edx, [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42f34d
push str._SystemRoot__system32_svchost.exe__k_DcomLaunch
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32umpnpmgr.dll
jmp 0x42d94c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42f3cb
push str._SystemRoot__system32_services.exe
call fcn.00483565
add esp, 4
jmp 0x42f3fa
lea edx, [esp + 0x1ac]
push str.services.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.RDSessMgr
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42f4f0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42f484
push str._SystemRoot__system32_sessmgr.exe
call fcn.00483565
add esp, 4
jmp 0x42f4b3
lea eax, [esp + 0x1ac]
push str.sessmgr.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.RasAuto
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42f5a8
lea edx, [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42f562
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_rasauto.dll
jmp 0x42d94c
push str.RasMan
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42f661
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 2
lea ecx, [esp + 0x30]
push 0
push ecx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42f61b
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_rasmans.dll
jmp 0x4310a3
push str.RemoteAccess
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42f719
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x30]
push eax
push edx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42f6d3
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32mprdim.dll
jmp 0x42dd6e
push str.RemoteRegistry
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42f948
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jne 0x42f7fe
lea edx, [esp + 0x10]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call ebx
test eax, eax
jne 0x42f794
push str._SystemRoot__system32_svchost.exe__k_LocalService
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x42f7fe
push str._SystemRoot_System32_regsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp dword [esp + 0x18], 1
jne 0x42f8be
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42f854
push str._SystemRoot__system32_svchost.exe__k_regsvc
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42f8be
push str._SystemRoot_System32_regsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x1c], 1
jne 0x431e56
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42f8fd
push str._SystemRoot__system32_regsvc.exe
call fcn.00483565
add esp, 4
jmp 0x42f92c
lea eax, [esp + 0x1ac]
push str.regsvc.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
push str.ImagePath
jmp 0x42dd8d
push str.RSVP
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42faa4
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 1
jne 0x42f9ff
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42f9ff
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42f9ab
push str._SystemRoot__system32_rsvp.exe__s
call fcn.00483565
add esp, 4
jmp 0x42f9da
lea ecx, [esp + 0x1ac]
push str.rsvp.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp ebx, 1
jne 0x431e56
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42fa40
push str._SystemRoot__system32_rsvp.exe
call fcn.00483565
add esp, 4
jmp 0x42fa6f
lea edx, [esp + 0x1ac]
push str.rsvp.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.SCardSvr
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42fc05
cmp ebx, 1
je 0x42fb77
cmp ebp, 1
je 0x42fb77
cmp edi, 1
jne 0x42fc05
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x30]
push eax
push edx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42fb31
push str._SystemRoot__system32_svchost.exe__k_LocalServiceAndNoImpersonation
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32ScardSvr.dll
jmp 0x42dd6e
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42fbaf
push str._SystemRoot__system32SCardSvr.exe
call fcn.00483565
add esp, 4
jmp 0x42fbde
lea ecx, [esp + 0x1ac]
push str.SCardSvr.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x431e4b
push str.SENS
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42fcbe
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 2
lea ecx, [esp + 0x30]
push 0
push ecx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42fc78
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_sens.dll
jmp 0x4310a3
push str.SSDPSRV
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42fe63
cmp ebx, 1
jne 0x42fd7f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x30]
push eax
push edx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42fd39
push str._SystemRoot__system32_svchost.exe__k_LocalService
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_ssdpsrv.dll
jmp 0x430ce6
cmp edi, 1
jne 0x42fe63
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x10]
push edx
push 2
lea eax, [esp + 0x30]
push 0
push eax
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42fde5
push str._SystemRoot__system32_svchost.exe__k_LocalServiceAndNoImpersonation
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_ssdpsrv.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.Schedule
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x42ffba
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x42fe9b
cmp dword [esp + 0x18], 1
jne 0x42ff50
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42fee6
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x42ff50
push str._SystemRoot_System32_schedsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x1c], 1
jne 0x431e56
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot__system32MSTask.exe
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.SharedAccess
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x430072
lea edx, [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43002c
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32ipnathlp.dll
jmp 0x42fe26
push str.Spooler
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43012c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4300c0
push str._SystemRoot__system32_spoolsv.exe
call fcn.00483565
add esp, 4
jmp 0x4300ef
lea edx, [esp + 0x1ac]
push str.spoolsv.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.SysmonLog
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4301e5
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x430179
push str._SystemRoot__system32_smlogsvc.exe
call fcn.00483565
add esp, 4
jmp 0x4301a8
lea eax, [esp + 0x1ac]
push str.smlogsvc.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.TapiSrv
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x430435
mov ecx, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp ecx, eax
je 0x430224
cmp dword [esp + 0x18], eax
jne 0x4302d9
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x43026f
push str._SystemRoot__system32_svchost.exe__k_tapisrv
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x4302d9
push str._SystemRoot_System32_tapisrv.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp dword [esp + 0x24], 1
jne 0x430399
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x43032f
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x430399
push str._SystemRoot_System32_tapisrv.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x20], 1
jne 0x431e56
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x4303ef
push str._SystemRoot__system32_svchost.exe__k_NetworkService
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_tapisrv.dll
jmp 0x430ce6
push str.TermService
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43070a
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 1
jne 0x43051f
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x4304b5
push str._SystemRoot__system32_svchost.exe__k_termsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x43051f
push str._SystemRoot_System32_termsrv.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp dword [esp + 0x24], 1
jne 0x4305df
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x430575
push str._SystemRoot__system32_svchost.exe__k_DcomLaunch
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x4305df
push str._SystemRoot_System32_termsrv.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x1c], 1
jne 0x43066e
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x43066e
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x43061a
push str._SystemRoot__system32_termsrv.exe
call fcn.00483565
add esp, 4
jmp 0x430649
lea eax, [esp + 0x1ac]
push str.termsrv.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
cmp dword [esp + 0x20], 1
jne 0x431e56
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x4306c4
push str._SystemRoot__system32_svchost.exe__k_NetworkService
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_termsrv.dll
jmp 0x42fe26
push str.Themes
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x430893
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x430742
cmp dword [esp + 0x18], 1
jne 0x4307f7
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x43078d
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x4307f7
push str._SystemRoot_System32_shsvcs.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x20], 1
jne 0x431e56
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x43084d
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_themeservice.dll
jmp 0x430ce6
push str.TlntSvr
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x430936
lea edx, [esp + 0x10]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4308e0
push str._SystemRoot__system32_tlntsvr.exe
call fcn.00483565
add esp, 4
jmp 0x43090f
lea ecx, [esp + 0x1ac]
push str.tlntsvr.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x431e4b
push str.TrkSvr
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x430ac3
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 1
jne 0x430a20
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x4309b6
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x430a20
push str._SystemRoot_System32_trksvr.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x1c], 1
jne 0x431e56
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x430a5f
push str._SystemRoot__system32_services.exe
call fcn.00483565
add esp, 4
jmp 0x430a8e
lea eax, [esp + 0x1ac]
push str.services.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.TrkWks
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x430d23
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 1
je 0x430af7
cmp ebx, 1
jne 0x430bb4
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430b46
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430bb4
push str._SystemRoot_System32_trkwks.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp dword [esp + 0x1c], 1
jne 0x430c47
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430c47
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x430bf3
push str._SystemRoot__system32_services.exe
call fcn.00483565
add esp, 4
jmp 0x430c22
lea edx, [esp + 0x1ac]
push str.services.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
cmp dword [esp + 0x20], 1
jne 0x431e56
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430ca1
push str._SystemRoot__system32_svchost.exe__k_LoclaSystemNetworkRestricted
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
push str._SystemRoot_System32_trkwks.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ServiceDll
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.Tssdis
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x430dc6
lea edx, [esp + 0x10]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x430d70
push str._SystemRoot__system32_tssdis.exe
call fcn.00483565
add esp, 4
jmp 0x430d9f
lea ecx, [esp + 0x1ac]
push str.tssdis.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x431e4b
push str.UtilMan
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x430e80
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x430e14
push str._SystemRoot__system32UtilMan.exe
call fcn.00483565
add esp, 4
jmp 0x430e43
lea edx, [esp + 0x1ac]
push str.UtilMan.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.W32Time
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4310e0
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 1
je 0x430eb4
cmp ebx, 1
jne 0x430f71
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430f03
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430f71
push str._SystemRoot_System32w32time.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ServiceDll
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
cmp dword [esp + 0x1c], 1
jne 0x431004
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431004
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x430fb0
push str._SystemRoot__system32_services.exe
call fcn.00483565
add esp, 4
jmp 0x430fdf
lea ecx, [esp + 0x1ac]
push str.services.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp dword [esp + 0x20], 1
jne 0x431e56
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43105e
push str._SystemRoot__system32_svchost.exe__k_LocalService
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
push str._SystemRoot_System32w32time.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push 0x49c864
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x431199
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x43112d
push str._SystemRoot__system32ups.exe
call fcn.00483565
add esp, 4
jmp 0x43115c
lea eax, [esp + 0x1ac]
push str.ups.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push 0x49c838
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x431331
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 1
je 0x4311cd
cmp ebx, 1
jne 0x43128a
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43121c
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43128a
push str._SystemRoot_System32_advapi32.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp dword [esp + 0x1c], 1
jne 0x431e56
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4312cd
push str._SystemRoot__system32_services.exe
call fcn.00483565
add esp, 4
jmp 0x4312fc
lea edx, [esp + 0x1ac]
push str.services.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.dmadmin
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4313ea
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x43137e
push str._SystemRoot__system32dmadmin.exe__com
call fcn.00483565
add esp, 4
jmp 0x4313ad
lea eax, [esp + 0x1ac]
push str.dmadmin.exe__com
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.mnmsrvc
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43148d
lea edx, [esp + 0x10]
push edx
push 2
push eax
lea eax, [esp + 0x34]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431e56
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x431437
push str._SystemRoot__system32mnmsrvc.exe
call fcn.00483565
add esp, 4
jmp 0x431466
lea ecx, [esp + 0x1ac]
push str.mnmsrvc.exe
push ecx
lea edx, [esp + 0x134]
push 0x4966e0
push edx
call fcn.0047a8f8
lea eax, [esp + 0x13c]
push eax
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x431e4b
push str.stisvc
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x431546
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 2
lea ecx, [esp + 0x30]
push 0
push ecx
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x431500
push str._SystemRoot__system32_svchost.exe__k_imgsvc
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431d46
push str._SystemRoot_System32wiaservc.dll
jmp 0x431791
push str.wuauserv
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4317ce
mov ecx, dword [esp + 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp ecx, eax
je 0x431585
cmp dword [esp + 0x18], eax
jne 0x43163a
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x4315d0
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x43163a
push str._SystemRoot_System32wuauserv.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ServiceDll
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
cmp dword [esp + 0x1c], 1
jne 0x4316fa
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431690
push str._SystemRoot__system32_svchost.exe__k_wugroup
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x4316fa
push str._SystemRoot_System32wuauserv.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp dword [esp + 0x20], 1
jne 0x431d46
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431750
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431d46
push str._SystemRoot_System32wuaueng.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.winmgmt
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x43192e
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp ebx, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x43180f
cmp dword [esp + 0x18], eax
je 0x43180f
cmp dword [esp + 0x20], eax
jne 0x4318c4
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x43185a
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x2c4]
lea eax, [esp + 0x28]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebx
test eax, eax
jne 0x4318c4
push str._SystemRoot_System32wbemWMIsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ServiceDll
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
cmp dword [esp + 0x1c], 1
jne 0x431d46
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431d46
push str._SystemRoot__system32WBEMWinMgmt.exe
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.SNMPTRAP
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4319e8
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431d46
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x43197c
push str._SystemRoot__system32_snmptrap.exe
call fcn.00483565
add esp, 4
jmp 0x4319ab
lea edx, [esp + 0x1ac]
push str.snmptrap.exe
push edx
lea eax, [esp + 0x134]
push 0x4966e0
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x13c]
push ecx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.SNMP
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x431a8b
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431d46
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x431a35
push str._SystemRoot__system32_snmp.exe
call fcn.00483565
add esp, 4
jmp 0x431a64
lea eax, [esp + 0x1ac]
push str.snmp.exe
push eax
lea ecx, [esp + 0x134]
push 0x4966e0
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x13c]
push edx
call fcn.00483565
add esp, 0x14
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x431d3b
push str.Netman
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x431c4f
mov ecx, dword [esp + 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp ecx, eax
je 0x431aca
cmp dword [esp + 0x18], eax
jne 0x431b7f
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431b15
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x2c4]
lea ecx, [esp + 0x28]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebx
test eax, eax
jne 0x431b7f
push str._SystemRoot_System32_netman.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
cmp dword [esp + 0x20], 1
jne 0x431c3f
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431bd5
push str._SystemRoot__system32_svchost.exe__k_LoclaSystemNetworkRestricted
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esp + 0x2c4]
lea edx, [esp + 0x28]
push ecx
push str.SYSTEMCurrentControlSetServices_sParameters
push edx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebx
test eax, eax
jne 0x431c3f
push str._SystemRoot_System32_netman.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ServiceDll
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.WmdmPmSN
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x431d56
push str.WmdmPmSN
call fcn.00483565
mov esi, eax
lea ecx, [esp + 0x2c]
push esi
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.0047a8f8
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x431cdf
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ImagePath
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [esp + 0x2c]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 2
push 0
push edx
push closesocket
call ebp
test eax, eax
jne 0x431d46
push str._SystemRoot_System32MsPMSNSv.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x20]
push str.ServiceDll
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
push str.wscsvc
push esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x431e66
cmp ebx, 1
jne 0x431e56
push str.wscsvc
call fcn.00483565
mov esi, eax
lea edx, [esp + 0x2c]
push esi
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.0047a8f8
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push 2
push 0
push ecx
push closesocket
call ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x431def
push str._SystemRoot__system32_svchost.exe__k_netsvcs
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 2
push eax
push str.ImagePath
push edx
call ebx
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [esp + 0x2c]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
mov byte [esp + 0x34], 0
call fcn.0047a8f8
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push 2
push 0
push eax
push closesocket
call ebp
test eax, eax
jne 0x431e56
push str._SystemRoot_System32wscsvc.dll
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 2
push eax
push str.ServiceDll
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2b0
ret
mov eax, 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b0
ret