Function at 0x401170
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0xc
call fcn.0041328e
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx], 0x4d054d
push ebx
add ebx, 4
push ebx
push 4
call fcn.0041328e
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
push 0x30004
push 0
push ebx
push 1
mov eax, 2
mov ebx, 0x478640
call fcn.004132b2
add esp, 0x10
pop ebx
add ebx, 4
push ebx
push 4
call fcn.0041328e
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
push 0x30005
push 0
push ebx
push 1
mov eax, 2
mov ebx, 0x478960
call fcn.004132b2
add esp, 0x10
pop ebx
pop ebx
push ebx
mov eax, esp
push eax
call fcn.00408fb3
pop ebx
mov dword [ebp - 0x10], 0
push 4
call fcn.0041328e
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
push 0x30004
push 0
push ebx
push 1
mov eax, 2
mov ebx, 0x478640
call fcn.004132b2
add esp, 0x10
push 0xffffffffffffffff
push 0x10
push 0x16012fb9
push 0x52010001
call fcn.004132c4
add esp, 0x10
test eax, eax
je 0x401344
push 0
mov ebx, 0x413830
call fcn.004132a6
add esp, 4
mov dword [ebp - 0x18], eax
push 0
mov ebx, 0x413850
call fcn.004132a6
add esp, 4
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 0x4d0460
push dword [ebp - 0x18]
mov ecx, 3
call fcn.0040106f
add esp, 0xc
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4012e1
push ebx
call fcn.00413294
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4012f1
push ebx
call fcn.00413294
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x401304
mov eax, 0x4d0462
push eax
push VariantClear
push 0
push str.softwaremicrosoftwindowsCurrentVersionRunwhh
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x415040
call fcn.004132a6
add esp, 0x28
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x40133f
push ebx
call fcn.00413294
add esp, 4
jmp 0x40136e
push VariantClear
push 0
push str.softwaremicrosoftwindowsCurrentVersionRunwhh
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x415060
call fcn.004132a6
add esp, 0x1c
push 0xffffffffffffffff
push 0x26
push 0x16010009
push 0x52010001
call fcn.004132c4
add esp, 0x10
mov dword [ebp - 0x18], eax
push VariantClear
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x40139a
mov eax, 0x4d0462
push eax
push 1
mov ebx, 0x413e50
call fcn.004132a6
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4013c0
push ebx
call fcn.00413294
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4013e4
cmp dword [ebp - 4], 0xc8
jg 0x4013e4
mov eax, 1
jmp 0x4013e9
mov eax, 0
test eax, eax
je 0x401509
cmp dword [ebp - 4], 0xa
jge 0x40145f
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x414b00
call fcn.004132a6
add esp, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0x4d0495
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401442
push ebx
call fcn.00413294
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401456
push ebx
call fcn.00413294
add esp, 4
pop eax
mov dword [ebp - 8], eax
jmp 0x401504
cmp dword [ebp - 4], 0x64
jge 0x4014cd
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x414b00
call fcn.004132a6
add esp, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0x4d0498
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4014b0
push ebx
call fcn.00413294
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4014c4
push ebx
call fcn.00413294
add esp, 4
pop eax
mov dword [ebp - 8], eax
jmp 0x401504
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x414b00
call fcn.004132a6
add esp, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401500
push ebx
call fcn.00413294
add esp, 4
pop eax
mov dword [ebp - 8], eax
jmp 0x40152d
push 0
push 0x4d049a
push 0xffffffffffffffff
push 0x14
push 0x16012ef0
push 0x52010001
call fcn.004132be
add esp, 0x18
xor ebx, ebx
jmp 0x401b51
push 0xffffffffffffffff
push 0x26
push 0x16010004
push 0x52010001
call fcn.004132c4
add esp, 0x10
mov dword [ebp - 0x18], eax
push VariantClear
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x401559
mov eax, 0x4d0462
push eax
push 1
mov ebx, 0x414150
call fcn.004132a6
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40157f
push ebx
call fcn.00413294
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401592
mov eax, 0x4d0462
push eax
push 1
mov ebx, 0x413d30
call fcn.004132a6
add esp, 0x10
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4015b8
push ebx
call fcn.00413294
add esp, 4
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [0x7ce6d0]
test ebx, ebx
je 0x4015cf
push ebx
call fcn.00413294
add esp, 4
pop eax
mov dword [0x7ce6d0], eax
push 0xffffffffffffffff
push 0x26
push 0x16010007
push 0x52010001
call fcn.004132c4
add esp, 0x10
mov dword [ebp - 0x18], eax
push VariantClear
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x401601
mov eax, 0x4d0462
push eax
push 1
mov ebx, 0x414150
call fcn.004132a6
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401627
push ebx
call fcn.00413294
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40163a
mov eax, 0x4d0462
push eax
push 1
mov ebx, 0x413d30
call fcn.004132a6
add esp, 0x10
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401660
push ebx
call fcn.00413294
add esp, 4
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [0x7ce6d4]
test ebx, ebx
je 0x401677
push ebx
call fcn.00413294
add esp, 4
pop eax
mov dword [0x7ce6d4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x401699
push eax
mov ebx, eax
call fcn.00401004
inc eax
push eax
call fcn.0041328e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [0x7ce6d8]
test ebx, ebx
je 0x4016ad
push ebx
call fcn.00413294
add esp, 4
pop eax
mov dword [0x7ce6d8], eax
push VariantClear
push 0
mov eax, dword [0x7ce6d0]
test eax, eax
jne 0x4016c8
mov eax, 0x4d0462
push eax
push 1
mov ebx, 0x4137f0
call fcn.004132a6
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x40170c
push 0
push 0x4d04ba
push 0xffffffffffffffff
push 0x14
push 0x16012ef0
push 0x52010001
call fcn.004132be
add esp, 0x18
xor ebx, ebx
jmp 0x401b51
push VariantClear
push 0
mov eax, dword [0x7ce6d4]
test eax, eax
jne 0x401721
mov eax, 0x4d0462
push eax
push 1
mov ebx, 0x4137f0
call fcn.004132a6
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x401765
push 0
push 0x4d04cd
push 0xffffffffffffffff
push 0x14
push 0x16012ef0
push 0x52010001
call fcn.004132be
add esp, 0x18
xor ebx, ebx
jmp 0x401b51
mov eax, str.login
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, str.type
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x40179b
push ebx
call fcn.00413294
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4017ab
push ebx
call fcn.00413294
add esp, 4
push 0x7ce6d0
mov eax, str.user
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4017da
push ebx
call fcn.00413294
add esp, 4
push 0x7ce6d4
mov eax, 0x4d04f0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401809
push ebx
call fcn.00413294
add esp, 4
push 0x7ce6d8
mov eax, 0x4d04f4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401838
push ebx
call fcn.00413294
add esp, 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00401bb3
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401865
push ebx
call fcn.00413294
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x401879
push ebx
call fcn.00413294
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push 0x4d0462
push dword [ebp - 0x10]
call fcn.004010cb
add esp, 8
cmp eax, 0
jne 0x4018ba
push 0
push 0x4d04f8
push 0xffffffffffffffff
push 0x14
push 0x16012ef0
push 0x52010001
call fcn.004132be
add esp, 0x18
xor ebx, ebx
jmp 0x401b51
mov ebx, 9
call fcn.00401168
push VariantClear
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4018d7
mov eax, 0x4d0462
push eax
push 0x30004
push 0
push dword [ebp - 0x14]
push 5
mov eax, 2
mov ebx, 0x479320
call fcn.004132b2
add esp, 0x40
push VariantClear
push 0
push 0x4d050d
push 0x30004
push 0
push dword [ebp - 0x14]
push 2
mov eax, 2
mov ebx, 0x4786e0
call fcn.004132b2
add esp, 0x1c
mov dword [ebp - 0x18], eax
push 0x4d0511
push dword [ebp - 0x18]
call fcn.004010cb
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401957
push ebx
call fcn.00413294
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x4019c3
push VariantClear
push 0
push 0x4d050d
push 0x30004
push 0
push dword [ebp - 0x14]
push 2
mov eax, 2
mov ebx, 0x4786e0
call fcn.004132b2
add esp, 0x1c
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x18]
push 0xffffffffffffffff
push 0x14
push 0x16012ef0
push 0x52010001
call fcn.004132be
add esp, 0x18
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4019bc
push ebx
call fcn.00413294
add esp, 4
xor ebx, ebx
jmp 0x401b51
push 0
push 0
push 0xffffffffffffffff
push 8
push 0x16012fa3
push 0x52010001
call fcn.004132be
add esp, 0x18
push VariantClear
push 0
push str.token
push 0x30004
push 0
push dword [ebp - 0x14]
push 2
mov eax, 2
mov ebx, 0x4786e0
call fcn.004132b2
add esp, 0x1c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, str.kh_token
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408f2c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401a35
push ebx
call fcn.00413294
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401a45
push ebx
call fcn.00413294
add esp, 4
push VariantClear
push 0
push 0x4d0529
push 0x30004
push 0
push dword [ebp - 0x14]
push 2
mov eax, 2
mov ebx, 0x4786e0
call fcn.004132b2
add esp, 0x1c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, str.kh_ip_list
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408f2c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401a9a
push ebx
call fcn.00413294
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401aaa
push ebx
call fcn.00413294
add esp, 4
push 0x7ce6d0
mov eax, str.kh_user
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00408f2c
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401ad0
push ebx
call fcn.00413294
add esp, 4
push 0x7ce6d4
mov eax, str.kh_pwd
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00408f2c
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401af6
push ebx
call fcn.00413294
add esp, 4
push 0x7ce6d8
mov eax, str.kh_num
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00408f2c
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401b1c
push ebx
call fcn.00413294
add esp, 4
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0
push 0
push 0
push 0x10001
push 0x6010011
push 0x52010012
push 3
mov ebx, 0x413780
call fcn.004132a6
add esp, 0x28
xor ebx, ebx
push eax
push ebx
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401b63
push ebx
call fcn.00413294
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.00413294
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x401b83
push ebx
call fcn.00413294
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
push 0x30004
push 0
push ebx
push 1
mov eax, 2
mov ebx, 0x478660
call fcn.004132b2
add esp, 0x10
call fcn.00413294
add esp, 4
pop ebx
pop eax
mov esp, ebp
pop ebp
ret 0x10