Function at 0x43874d
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get installed programs
Query or enumerate registry value
Resolve dns
Send data
Send data on socket
Set registry value

Disassembly:
push 0xa8c
mov eax, 0x5bf6cc
call fcn.00580ed4
mov esi, ecx
and dword [ebp - 4], 0
lea eax, [ebp - 0x91c]
push eax
mov byte [ebp - 0x8f1], 0
call fcn.0040850b
mov byte [ebp - 4], 1
lea ebx, [esi + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x24]
lea edi, [ebp - 0x91c]
call fcn.004085c5
mov esi, dword [esi + 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
or ebx, 0xffffffff
mov dword [ebp - 0x94c], edi
cmp edi, ebx
jne 0x4387fe
cmp dword [0x6af38c], 3
jl 0x4387da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.socket_error____i
push str.Reporter::SendReport
push 3
call fcn.00532962
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x91c]
call fcn.004085a2
mov dword [ebp - 4], ebx
lea ecx, [ebp + 8]
call fcn.004085a2
xor al, al
call fcn.00580f57
ret 8
push 2
pop eax
push esi
mov word [ebp - 0x8cc], ax
call dword [sym.imp.WS2_32.dll_htons]
push ecx
mov word [ebp - 0x8ca], ax
mov eax, esp
mov dword [ebp - 0x8f8], esp
lea ecx, [ebp - 0x91c]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 2
lea eax, [ebp - 0x900]
push eax
mov byte [ebp - 4], 1
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 3
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x8c8], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x900]
call fcn.00408461
cmp dword [ebp - 0x8c8], ebx
jne 0x4388fa
push ecx
mov eax, esp
mov dword [ebp - 0x8f8], esp
lea ecx, [ebp - 0x91c]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 4
lea eax, [ebp - 0x900]
push eax
mov byte [ebp - 4], 1
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 5
push dword [eax]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x900]
call fcn.00408461
test esi, esi
jne 0x4388e1
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [0x6af38c], 3
jl 0x4387da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.gethostbyname_error____i
jmp 0x4387cb
movsx eax, word [esi + 0xa]
push eax
mov eax, dword [esi + 0xc]
push dword [eax]
lea eax, [ebp - 0x8c8]
push eax
call fcn.005784a0
add esp, 0xc
push 0x10
lea eax, [ebp - 0x8cc]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, ebx
jne 0x43893e
xor bl, bl
push dword [ebp - 0x94c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x91c]
call fcn.004085a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004085a2
mov al, bl
jmp 0x4387f6
push 0x6793c8
lea eax, [ebp + 8]
push eax
call fcn.00426229
push dword [0x6c8ed4]
lea eax, [ebp + 8]
push eax
call fcn.00426229
mov esi, 0x100000
push esi
call fcn.00573e8f
pop ecx
push esi
mov ebx, eax
push 0
push ebx
call fcn.005783f0
pop ecx
pop ecx
mov eax, esp
mov dword [ebp - 0x8f8], esp
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 6
lea eax, [ebp - 0x900]
push eax
mov byte [ebp - 4], 1
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 7
mov eax, dword [eax]
mov edx, ebx
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4389a4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x900]
call fcn.00408461
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4389c2
sub eax, esi
xor esi, esi
mov edi, eax
mov dword [ebp - 0x908], esi
push 0
push edi
lea eax, [esi + ebx]
push eax
push dword [ebp - 0x94c]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x438a0f
mov byte [ebp - 0x8f1], 1
cmp eax, 0xffffffff
je 0x438a0f
add esi, eax
cmp eax, edi
je 0x438a0f
sub edi, eax
inc dword [ebp - 0x908]
cmp dword [ebp - 0x908], 0xa
jl 0x4389d5
push ebx
call fcn.00573db2
xor edi, edi
pop ecx
cmp esi, edi
je 0x439b7d
cmp byte [ebp + 0xc], 0
je 0x439b7d
push dword [ebp - 0x94c]
lea eax, [ebp - 0x920]
push eax
call fcn.00438565
mov byte [ebp - 4], 8
xor ebx, ebx
inc ebx
cmp dword [0x6af38c], ebx
jl 0x438aa5
push ecx
mov eax, esp
mov dword [ebp - 0x8f8], esp
lea ecx, [ebp - 0x920]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 9
lea eax, [ebp - 0x900]
push eax
mov byte [ebp - 4], 8
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
mov esi, eax
call fcn.004084f4
push eax
push str.Receive_data:__s
push str.Reporter::SendReport
push ebx
call fcn.00532962
add esp, 0x10
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x900]
call fcn.00408461
mov eax, dword [ebp - 0x920]
cmp dword [eax - 0xc], edi
jle 0x439b6e
push str.set_keywords:
xor ecx, ecx
lea esi, [ebp - 0x920]
call fcn.00426385
test eax, eax
jne 0x438e3c
mov eax, esi
push eax
lea eax, [ebp - 0x904]
push eax
call fcn.00408532
mov byte [ebp - 4], 0xb
push 0x677680
xor ecx, ecx
lea esi, [ebp - 0x904]
call fcn.00426385
inc eax
mov ecx, esi
call fcn.004261d8
lea eax, [ebp - 0xa7c]
push eax
call fcn.00434628
mov byte [ebp - 4], 0xc
push ecx
mov esi, esp
mov dword [ebp - 0x8f8], esp
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
lea ecx, [ebp - 0x904]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 0xd
push esi
mov byte [ebp - 4], 0xc
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0xa7c]
push eax
mov byte [ebp - 4], 0xc
call fcn.004346ed
call fcn.00431829
mov ebx, eax
cmp ebx, edi
je 0x438dd7
mov eax, dword [ebx]
lea ecx, [ebp - 0xa7c]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov eax, dword [ebp - 0x9fc]
mov eax, dword [eax]
mov dword [ebp - 0x910], eax
mov eax, dword [ebp - 0xa14]
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0xa14]
lea edi, [ebp - 0x93c]
lea esi, [ebp - 0x914]
mov dword [ebp - 0x93c], eax
call fcn.00427527
test al, al
jne 0x438c3c
push 0xa7
mov byte [ebp - 0xbc], al
lea eax, [ebp - 0xbb]
push 0
push eax
call fcn.005783f0
add esp, 0xc
lea eax, [ebp - 0xbc]
push eax
call fcn.0043e3b4
push ecx
add eax, 4
mov ecx, esp
mov dword [ebp - 0x8f8], esp
push eax
push ecx
call fcn.0040fc24
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0xc
call fcn.0042117e
pop ecx
pop ecx
push 0xa8
lea eax, [ebp - 0xbc]
push eax
call fcn.0043e3b4
push ecx
mov ecx, esp
mov dword [ebp - 0x8f8], esp
push eax
push ecx
call fcn.0040fc24
mov byte [ebp - 4], 0x10
mov eax, dword [ebx]
add eax, 0xc
mov byte [ebp - 4], 0xc
mov ecx, ebx
call dword [eax]
call fcn.00416788
jmp 0x438b85
lea eax, [ebp - 0x8ec]
push eax
call fcn.0040f817
mov byte [ebp - 4], 0x11
push 0
lea ecx, [ebp - 0x8ec]
call fcn.004100fc
test al, al
je 0x438dc7
lea eax, [ebp - 0x8ec]
push eax
call fcn.004117c1
mov eax, dword [ebp - 0xa6c]
sub eax, dword [ebp - 0xa70]
mov ecx, 0x218
cdq
idiv ecx
and dword [ebp - 0x8f0], 0
test eax, eax
jbe 0x438cdb
push dword [ebp - 0x8f0]
lea esi, [ebp - 0xa7c]
call fcn.0043be23
sub esp, 0x218
mov esi, eax
mov edi, esp
mov ecx, 0x86
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x8ec]
call fcn.00411712
mov eax, dword [ebp - 0xa6c]
sub eax, dword [ebp - 0xa70]
mov ecx, 0x218
cdq
idiv ecx
inc dword [ebp - 0x8f0]
cmp dword [ebp - 0x8f0], eax
jb 0x438c8c
mov eax, dword [ebp - 0xa1c]
mov eax, dword [eax]
mov dword [ebp - 0x910], eax
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0xa34]
lea edi, [ebp - 0x93c]
lea esi, [ebp - 0x914]
mov dword [ebp - 0x93c], eax
call fcn.00427527
test al, al
jne 0x438d59
call fcn.0043e3b4
movzx eax, byte [eax + 4]
push eax
call fcn.0043e3b4
push ecx
mov ecx, esp
mov dword [ebp - 0x8f8], esp
push eax
push ecx
call fcn.0040fc24
mov byte [ebp - 4], 0x12
mov eax, dword [ebx]
add eax, 0x10
mov byte [ebp - 4], 0x11
mov ecx, ebx
call dword [eax]
call fcn.00416788
jmp 0x438cf5
push dword [ebp - 0x9e4]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0x6b29e8
call esi
push dword [ebp - 0x9e4]
push ecx
mov eax, esp
mov dword [ebp - 0x8f8], esp
push str.ShowBandwidth90p
push eax
call fcn.00408561
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x11
call fcn.0042c6a3
push dword [ebp - 0x9e0]
push 0x6b29ec
call esi
push dword [ebp - 0x9e0]
push ecx
mov eax, esp
mov dword [ebp - 0x8f8], esp
push str.ShowBandwidth100p
push eax
call fcn.00408561
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x11
call fcn.0042c6a3
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x8ec]
push eax
call fcn.0040f843
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0xa14]
push eax
call fcn.0042d22b
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0xa34]
push eax
call fcn.004351d4
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0xa64]
push eax
call fcn.00448a80
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xa7c]
push eax
call fcn.00448a80
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x904]
call fcn.004085a2
jmp 0x439b6e
lea eax, [ebp - 0x98c]
push eax
call fcn.0044884e
mov byte [ebp - 4], 0x1a
lea esi, [ebp - 0x920]
call fcn.004087dc
push eax
lea esi, [ebp - 0x9d8]
call fcn.004081bb
mov byte [ebp - 4], 0x1b
push 0x3b
lea edx, [ebp - 0x98c]
mov ecx, esi
call fcn.0041d4bd
pop ecx
mov byte [ebp - 4], 0x1a
push edi
push ebx
call fcn.00409c0f
mov eax, dword [ebp - 0x97c]
sub eax, dword [ebp - 0x980]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x908], edi
test eax, eax
jbe 0x439b5e
jmp 0x438ea7
xor ebx, ebx
inc ebx
push dword [ebp - 0x908]
lea esi, [ebp - 0x98c]
call fcn.004487e1
cmp dword [eax + 0x18], 8
jb 0x438ec3
mov eax, dword [eax + 4]
jmp 0x438ec6
add eax, 4
push eax
lea eax, [ebp - 0x8f0]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x8f0]
cmp dword [eax - 0xc], edi
je 0x439b2b
push str.Quick_Scan
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x438f30
call fcn.00456612
push edi
push edi
push ebx
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x8fc], esp
push 0x67945c
push eax
call fcn.0040f8bd
mov byte [ebp - 4], 0x1d
push esi
mov byte [ebp - 4], 0x1c
call fcn.0045df7c
push eax
mov ecx, esi
call fcn.00465e61
push str.Full_Scan
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x438f7a
call fcn.00456612
push edi
push edi
push ebx
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x8fc], esp
push 0x679478
push eax
call fcn.0040f8bd
mov byte [ebp - 4], 0x1e
push esi
mov byte [ebp - 4], 0x1c
call fcn.0045df7c
push eax
mov ecx, esi
call fcn.00465e61
push str.Custom_Scan
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x439002
mov eax, esi
push eax
lea eax, [ebp - 0x904]
push eax
call fcn.00408532
mov byte [ebp - 4], 0x1f
push 0x677680
xor ecx, ecx
lea esi, [ebp - 0x904]
call fcn.00426385
inc eax
mov ecx, esi
call fcn.004261d8
call fcn.00456612
push edi
push edi
push ebx
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x8fc], esp
lea ecx, [ebp - 0x904]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 0x20
push esi
mov byte [ebp - 4], 0x1f
call fcn.0045df7c
push eax
mov ecx, esi
call fcn.00465e61
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x904]
call fcn.004085a2
push str.Device_Allow
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x439034
call fcn.00456612
push edi
call fcn.004614fa
mov ecx, dword [0x6c8a30]
add ecx, 0xc0
call fcn.0046cd9c
push str.Device_Block
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x439066
call fcn.00456612
push ebx
call fcn.004614fa
mov ecx, dword [0x6c8a30]
add ecx, 0xc0
call fcn.0046cd9c
push str.fw_enable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x43908d
call fcn.00431829
cmp eax, edi
je 0x43908d
mov edx, dword [eax]
push ebx
mov ecx, eax
call dword [edx + 4]
push str.fw_disable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x4390b4
call fcn.00431829
cmp eax, edi
je 0x4390b4
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 4]
push str.ssl_enable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x439102
push ebx
push 0x6b2a08
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push dword [0x6b2a08]
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
push str.EnableSSL
push eax
call fcn.00408561
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x1c
call fcn.0042c6a3
call fcn.00431cbe
push str.ssl_disable
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x439150
push edi
push 0x6b2a08
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push dword [0x6b2a08]
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
push str.EnableSSL
push eax
call fcn.00408561
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x1c
call fcn.0042c6a3
call fcn.00431cbe
push str.USB_Protection:
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x4394e5
lea eax, [ebp - 0x9bc]
push eax
call fcn.004137bf
mov byte [ebp - 4], 0x23
or dword [ebp - 0x918], 0xffffffff
or dword [ebp - 0x924], 0xffffffff
or dword [ebp - 0x90c], 0xffffffff
mov eax, esi
push eax
lea eax, [ebp - 0x958]
push eax
call fcn.00408532
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x9a4]
push eax
call fcn.0044884e
mov byte [ebp - 4], 0x25
lea esi, [ebp - 0x958]
call fcn.004087dc
push eax
lea esi, [ebp - 0xa98]
call fcn.004081bb
mov byte [ebp - 4], 0x26
push 0xd
lea edx, [ebp - 0x9a4]
mov ecx, esi
call fcn.0041d4bd
pop ecx
mov byte [ebp - 4], 0x25
push edi
push 1
call fcn.00409c0f
mov eax, dword [ebp - 0x994]
sub eax, dword [ebp - 0x998]
push 0x1c
cdq
pop ecx
idiv ecx
xor ebx, ebx
test eax, eax
jbe 0x439475
push ebx
lea esi, [ebp - 0x9a4]
call fcn.004487e1
cmp dword [eax + 0x18], 8
jb 0x43921c
mov eax, dword [eax + 4]
jmp 0x43921f
add eax, 4
push eax
lea eax, [ebp - 0x944]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x944]
call fcn.00426419
lea eax, [ebp - 0x974]
push eax
call fcn.0044884e
mov byte [ebp - 4], 0x28
lea esi, [ebp - 0x944]
call fcn.004087dc
push eax
lea esi, [ebp - 0x8e8]
call fcn.004081bb
mov byte [ebp - 4], 0x29
push 0x3a
lea edx, [ebp - 0x974]
mov ecx, esi
call fcn.0041d4bd
pop ecx
mov byte [ebp - 4], 0x28
push edi
push 1
call fcn.00409c0f
mov eax, dword [ebp - 0x964]
sub eax, dword [ebp - 0x968]
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, 2
jne 0x4393f5
push str.USB_Protection
push edi
lea esi, [ebp - 0x974]
call fcn.004487e1
call fcn.0041b604
pop ecx
test al, al
je 0x4392da
push 1
call fcn.004487e1
cmp dword [eax + 0x18], 8
jb 0x4392ca
mov eax, dword [eax + 4]
jmp 0x4392cd
add eax, 4
push eax
call fcn.00573da7
pop ecx
mov dword [ebp - 0x918], eax
push str.delay
push edi
lea esi, [ebp - 0x974]
call fcn.004487e1
call fcn.0041b604
pop ecx
test al, al
je 0x439317
push 1
call fcn.004487e1
cmp dword [eax + 0x18], 8
jb 0x439307
mov eax, dword [eax + 4]
jmp 0x43930a
add eax, 4
push eax
call fcn.00573da7
pop ecx
mov dword [ebp - 0x924], eax
push str.password
push edi
lea esi, [ebp - 0x974]
call fcn.004487e1
call fcn.0041b604
pop ecx
test al, al
je 0x439344
push 1
call fcn.004487e1
call fcn.0043870f
mov dword [ebp - 0x90c], eax
push str.excluded
push edi
lea esi, [ebp - 0x974]
call fcn.004487e1
call fcn.0041b604
pop ecx
test al, al
je 0x4393f5
push 0x672264
lea eax, [ebp - 0x95c]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x2a
push 1
call fcn.004487e1
cmp dword [eax + 0x18], 8
jb 0x43938a
mov eax, dword [eax + 4]
jmp 0x43938d
add eax, 4
push eax
lea eax, [ebp - 0x954]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x95c]
push eax
push 0x2c
lea ecx, [ebp - 0x954]
lea edi, [ebp - 0x9d4]
call fcn.004707d0
pop ecx
pop ecx
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x9bc]
call fcn.0043be76
mov byte [ebp - 4], 0x2b
mov eax, edi
push eax
call fcn.0041391c
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x954]
call fcn.004085a2
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x95c]
call fcn.004085a2
xor edi, edi
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x974]
push eax
call fcn.0043c4b5
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x944]
call fcn.004085a2
mov eax, dword [ebp - 0x994]
sub eax, dword [ebp - 0x998]
push 0x1c
cdq
pop ecx
idiv ecx
inc ebx
cmp ebx, eax
jb 0x439205
cmp dword [ebp - 0x90c], 0xffffffff
je 0x439449
call fcn.00456612
push dword [ebp - 0x90c]
push eax
call fcn.00462b7c
cmp dword [ebp - 0x918], 0xffffffff
je 0x439475
cmp dword [ebp - 0x924], 0xffffffff
je 0x439475
call fcn.00456612
push dword [ebp - 0x924]
mov ecx, eax
push dword [ebp - 0x918]
push 1
call fcn.00462684
call fcn.00456612
mov ebx, eax
mov eax, dword [ebp - 0x9ac]
sub eax, dword [ebp - 0x9b0]
sar eax, 2
test eax, eax
jbe 0x4394b4
lea esi, [ebp - 0x9bc]
call fcn.00413946
push eax
call fcn.00462878
mov eax, dword [ebp - 0x9ac]
sub eax, dword [ebp - 0x9b0]
inc edi
sar eax, 2
cmp edi, eax
jb 0x43948f
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x9a4]
push eax
call fcn.0043c4b5
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x958]
call fcn.004085a2
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x9bc]
push eax
call fcn.0041391c
xor edi, edi
push str.Exclude_drive:
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x439569
mov eax, esi
push eax
lea eax, [ebp - 0x92c]
push eax
call fcn.00408532
mov byte [ebp - 4], 0x2d
mov ebx, 0x677680
push ebx
xor ecx, ecx
lea esi, [ebp - 0x92c]
call fcn.00426385
inc eax
mov ecx, esi
call fcn.004261d8
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
mov ecx, esi
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0x2d
call fcn.0041ce2d
pop ecx
mov esi, eax
call fcn.00456612
push esi
mov ecx, eax
call fcn.004627b1
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x92c]
call fcn.004085a2
jmp 0x43956e
mov ebx, 0x677680
push str.Unexclude_drive:
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x4395eb
mov eax, esi
push eax
lea eax, [ebp - 0x928]
push eax
call fcn.00408532
mov byte [ebp - 4], 0x2f
push ebx
xor ecx, ecx
lea esi, [ebp - 0x928]
call fcn.00426385
inc eax
mov ecx, esi
call fcn.004261d8
push ecx
mov eax, esp
mov dword [ebp - 0x8fc], esp
mov ecx, esi
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x2f
call fcn.0041ce2d
pop ecx
mov esi, eax
call fcn.00456612
push esi
mov ecx, eax
call fcn.004629fe
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x928]
call fcn.004085a2
push str.opt_prot
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
je 0x439645
push str.opt_scan
xor ecx, ecx
call fcn.00426385
test eax, eax
je 0x439645
push str.opt_update
xor ecx, ecx
call fcn.00426385
test eax, eax
je 0x439645
push str.opt_sch
xor ecx, ecx
call fcn.00426385
test eax, eax
je 0x439645
push str.opt_logs
xor ecx, ecx
call fcn.00426385
test eax, eax
jne 0x4398e6
lea eax, [ebp - 0x8f0]
push eax
lea eax, [ebp - 0x930]
push eax
call fcn.00408532
mov byte [ebp - 4], 0x31
push ebx
xor ecx, ecx
lea esi, [ebp - 0x930]
call fcn.00426385
inc eax
mov ecx, esi
call fcn.004261d8
mov eax, esi
push eax
call fcn.00404151
mov eax, dword [0x6c8e0c]
sub eax, dword [0x6c8e08]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x4398d7
mov ecx, dword [0x6c8a30]
add ecx, 0xc0
call fcn.0046ccc6
call fcn.00401cbc
mov eax, dword [0x6c8e0c]
sub eax, dword [0x6c8e08]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x90c], edi
cmp eax, edi
jbe 0x4398b3
and dword [ebp - 0x918], 0
cmp edi, eax
jb 0x4396d8
call fcn.0057451a
mov eax, dword [0x6c8e08]
mov ecx, dword [ebp - 0x918]
lea edi, [ecx + eax]
mov eax, dword [edi]
test eax, eax
jne 0x439703
movzx edx, byte [edi + 0xc]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00401924
jmp 0x439884
cmp eax, 1
jne 0x43971d
push dword [edi + 0x10]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
call fcn.00401793
jmp 0x439884
cmp eax, 2
jne 0x43974e
push ecx
lea eax, [edi + 0x14]
mov ecx, esp
mov dword [ebp - 0x8fc], esp
push eax
call fcn.0040102d
mov byte [ebp - 4], 0x32
mov eax, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push edi
mov byte [ebp - 4], 0x31
call fcn.00401aba
jmp 0x439884
cmp eax, 3
jne 0x439884
push str.Realtime
lea ebx, [edi + 4]
push ebx
call fcn.00416ef5
test eax, eax
jne 0x439841
lea eax, [edi + 8]
mov esi, str.RealtimeNew
push esi
push eax
mov dword [ebp - 0x8fc], eax
call fcn.00416ef5
test eax, eax
jne 0x439841
push ecx
mov ecx, esp
mov dword [ebp - 0x938], esp
call fcn.004010c4
mov byte [ebp - 4], 0x33
push ecx
mov dword [ebp - 0x910], esp
mov dword [ebp - 0x924], esp
push 0xffffffffffffffff
push esi
call fcn.004bbc60
pop ecx
pop ecx
mov ecx, dword [ebp - 0x924]
mov dword [ecx], eax
mov byte [ebp - 4], 0x34
push str.Realtime
lea eax, [ebp - 0x948]
push eax
mov byte [ebp - 4], 0x31
call fcn.004012f8
mov byte [ebp - 4], 0x35
add edi, 0x18
push edi
lea ecx, [ebp - 0x948]
call fcn.0043c905
push ecx
lea eax, [ebp - 0x948]
mov ecx, esp
mov dword [ebp - 0x910], esp
push eax
call fcn.004010ed
mov byte [ebp - 4], 0x36
mov esi, dword [ebp - 0x8fc]
call fcn.004084f4
push ecx
mov dword [ebp - 0x938], esp
mov esi, esp
push 0xffffffffffffffff
push eax
call fcn.004bbc60
pop ecx
pop ecx
mov dword [esi], eax
mov byte [ebp - 4], 0x37
mov ebx, dword [ebx]
push ebx
mov byte [ebp - 4], 0x35
call fcn.004015ae
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x948]
call fcn.00401113
jmp 0x439884
push ecx
lea eax, [edi + 0x18]
mov ecx, esp
mov dword [ebp - 0x910], esp
push eax
call fcn.004010ed
mov byte [ebp - 4], 0x38
lea esi, [edi + 8]
call fcn.004084f4
push ecx
mov dword [ebp - 0x938], esp
mov esi, esp
push 0xffffffffffffffff
push eax
call fcn.004bbc60
pop ecx
pop ecx
mov dword [esi], eax
mov byte [ebp - 4], 0x39
mov ebx, dword [ebx]
push ebx
mov byte [ebp - 4], 0x31
call fcn.004015ae
mov eax, dword [0x6c8e0c]
sub eax, dword [0x6c8e08]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x90c]
add dword [ebp - 0x918], 0x1c
cmp dword [ebp - 0x90c], eax
jb 0x4396d8
mov ebx, 0x677680
call fcn.00401cbc
mov ecx, dword [0x6c8a30]
add ecx, 0xc0
call fcn.0046ccc6
call fcn.00456612
mov ecx, eax
call fcn.0045e058
xor edi, edi
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x930]
call fcn.004085a2
push str.opt_pass
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x4399e8
mov eax, esi
push eax
lea eax, [ebp - 0x934]
push eax
call fcn.00408532
mov byte [ebp - 4], 0x3a
push ebx
xor ecx, ecx
lea esi, [ebp - 0x934]
call fcn.00426385
inc eax
mov ecx, esi
call fcn.004261d8
mov ecx, dword [0x6c8a30]
add ecx, 0xc0
call fcn.0046ccc6
call fcn.00401cbc
push 1
push str.Locked
mov esi, str.Main
push esi
call fcn.00401924
push dword [ebp - 0x934]
call fcn.00573da7
pop ecx
push eax
push str.Password
push esi
mov dword [ebp - 0x8f8], eax
call fcn.00401793
push dword [0x6c8c4c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp eax, edi
je 0x4399c3
lea eax, [ebp - 0x950]
push eax
push 2
mov dword [ebp - 0x950], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
cmp dword [ebp - 0x950], edi
je 0x4399bd
push 4
lea eax, [ebp - 0x8f8]
push eax
push 4
push str.SP01
push str.SoftwareMicrosoftShared
push dword [ebp - 0x950]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
call fcn.00401cbc
mov ecx, dword [0x6c8a30]
add ecx, 0xc0
call fcn.0046ccc6
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x934]
call fcn.004085a2
push str.Download_Updates
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x439a0e
call fcn.00456612
push 0
mov ebx, eax
call fcn.0045df25
xor edi, edi
push str.Uninstall_Client
xor ecx, ecx
lea esi, [ebp - 0x8f0]
call fcn.00426385
test eax, eax
jne 0x439b2b
cmp dword [0x6c8c4c], edi
je 0x439b0e
lea eax, [ebp - 0x940]
push eax
call fcn.0040850b
mov byte [ebp - 4], 0x3b
push dword [0x6c8c4c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
lea eax, [ebp - 0x900]
push eax
lea eax, [ebp - 0x8bc]
push eax
push edi
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallVibranium_Threat_Security_is1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x900], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x439aa7
mov eax, dword [ebp - 0x900]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x8bc], cx
lea eax, [ebp - 0x8bc]
push eax
lea eax, [ebp - 0x940]
push eax
call fcn.00408606
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x940]
cmp dword [eax - 0xc], edi
je 0x439afd
mov esi, dword [0x6c8c4c]
push ecx
mov eax, esp
mov dword [ebp - 0x910], esp
push str._VERYSILENT
push eax
call fcn.00408561
mov byte [ebp - 4], 0x3c
push ecx
mov eax, esp
mov dword [ebp - 0x938], esp
lea ecx, [ebp - 0x940]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x3b
mov ecx, esi
call fcn.00438619
pop ecx
pop ecx
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x940]
call fcn.004085a2
jmp 0x439b2b
cmp dword [0x6af38c], 3
jl 0x439b2b
push str.User_token_is_not_available
push str.Reporter::SendReport
push 3
call fcn.00532962
add esp, 0xc
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x8f0]
call fcn.004085a2
mov eax, dword [ebp - 0x97c]
sub eax, dword [ebp - 0x980]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x908]
cmp dword [ebp - 0x908], eax
jb 0x438ea4
mov byte [ebp - 4], 8
lea eax, [ebp - 0x98c]
push eax
call fcn.0043c4b5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x920]
call fcn.004085a2
mov bl, byte [ebp - 0x8f1]
jmp 0x438910