Function at 0x4041a0
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Delete file
Persist via run registry key
Query environment variable
Self delete
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x120]
sub esp, 0x120
push 0xffffffffffffffff
push 0x44bd58
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x465d3c]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x12c]
push 0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0040edda
test eax, eax
jne 0x404237
push str.Fatal_Error:_MFC_initialization_failed
push 0x46a230
call fcn.00403e60
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404070
mov ecx, esi
call fcn.00403cb0
mov eax, 1
jmp 0x4047fa
lea eax, [ebp - 0x30]
push eax
call fcn.00402ed0
add esp, 4
mov eax, dword [ebp - 0x30]
push 1
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x28], esp
mov esi, esp
push eax
mov dword [ebp - 4], 0
call fcn.00401500
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0040b7c0
mov edi, dword [ebp + 0x128]
add esp, 8
cmp edi, 1
jg 0x4042ca
call fcn.00401400
push 0
push 0
cmp eax, 6
jb 0x40428e
push str.add__HKCUSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3___v_1a00__t_REG_DWORD__d_0x00030000__f
jmp 0x404293
push str.add__HKCUSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3___v_1a00__t_REG_DWORD__d_0__f
push 0x44fcfc
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
push esi
push str.TestUrl
call fcn.0040b960
push esi
push 0x44fcc0
call fcn.0043129a
add esp, 0x10
call fcn.00403200
jmp 0x4047d1
mov esi, dword [ebx + 4]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov ecx, str._iemode
mov eax, esi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404300
test dl, dl
je 0x4042fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404300
add eax, 2
add ecx, 2
test dl, dl
jne 0x4042e0
xor eax, eax
jmp 0x404305
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404331
push eax
push eax
push str.add__HKCUSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3___v_1a00__t_REG_DWORD__d_0__f
push 0x44fcfc
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push eax
push str.TestUrl
call fcn.0040b960
jmp 0x4047ce
mov ecx, str._gina_esb
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404358
test dl, dl
je 0x404354
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404358
add eax, 2
add ecx, 2
test dl, dl
jne 0x404338
xor eax, eax
jmp 0x40435d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4047d1
mov ecx, str._shutdown
mov eax, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404390
test dl, dl
je 0x40438c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404390
add eax, 2
add ecx, 2
test dl, dl
jne 0x404370
xor eax, eax
jmp 0x404395
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4043a8
push 2
call fcn.0040ada0
add esp, 4
jmp 0x4047d1
mov ecx, str._shutdown_choise
mov eax, esi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4043d0
test dl, dl
je 0x4043cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4043d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4043b0
xor eax, eax
jmp 0x4043d5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404736
mov ax, word [0x44fc88]
mov ecx, dword [str.systemroot]
mov edx, dword [0x44fc84]
mov word [ebp + 0x110], ax
xor eax, eax
push 0x104
mov dword [ebp + 0x10c], edx
mov dword [ebp + 0x108], ecx
mov cl, byte [0x44fc8a]
push eax
lea edx, [ebp + 1]
push edx
mov byte [ebp + 0x112], cl
mov dword [ebp + 0x113], eax
mov dword [ebp + 0x117], eax
mov byte [ebp + 0x11b], al
mov byte [ebp], al
call fcn.00431220
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x4044fb
push str.cache.dat
lea ecx, [ebp - 0x14]
call fcn.00402a70
mov esi, eax
lea edx, [ebp]
push edx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00402a70
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.00402610
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
push eax
call esi
lea ecx, [ebp - 0x1c]
call fcn.00401020
lea ecx, [ebp - 0x18]
call fcn.00401020
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00401020
push str.CachePolicy.dat
lea ecx, [ebp - 0x14]
call fcn.00402a70
mov edi, eax
lea ecx, [ebp]
push ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00402a70
push edi
push eax
lea edx, [ebp - 0x1c]
push edx
mov byte [ebp - 4], 4
call fcn.00402610
mov eax, dword [eax]
add esp, 0xc
push eax
call esi
lea ecx, [ebp - 0x1c]
call fcn.00401020
lea ecx, [ebp - 0x18]
call fcn.00401020
lea ecx, [ebp - 0x14]
call fcn.00401020
lea ecx, [ebp - 0x20]
call fcn.004018b0
cmp dword [ebp + 0x128], 4
mov bl, 5
mov byte [ebp - 4], bl
jl 0x40468f
mov esi, dword [ebp - 0x24]
mov eax, dword [esi + 8]
push eax
lea ecx, [ebp - 0x24]
call fcn.00402a70
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.00402100
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00401020
mov ecx, dword [esi + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402a70
lea ecx, [ebp - 0x18]
call fcn.004018b0
lea ecx, [ebp - 0x14]
call fcn.004018b0
lea ecx, [ebp - 0x28]
call fcn.004018b0
mov bl, 0xa
push str._tempRestart.bat
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00402a70
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xb
call fcn.00402750
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00401020
mov edx, dword [ebp - 0x1c]
push str.ClientProxy..UpdateDigitalTrust_Setup.msi
push edx
lea eax, [ebp - 0x18]
push str._s_s
push eax
call fcn.00402380
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push str.del__q_tempRestart.bat
push str.del__q_DigitalTrust_Setup.msi
push str.DigitalTrust_Setup.msi
push 0x44fa10
push ecx
push 0x44fa10
push str.rd__s__q
push str._DigitalTrust_Setup.msi
push 0x44fa10
push edx
push 0x44fa10
push str.copy
push str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun___v_ClearShell__f
push str.set_currpath_cd_
push str.cd__d__dp0_
push str._echo_off_r_necho
lea eax, [ebp - 0x14]
push str.__s_r_n__s_r_n__s_r_n__s_r_n__s_s_s_s_s_r_n__s_s_s_s_r_n__s_r_n__s_r_n__s_r_n
push eax
call fcn.00402380
mov bl, 0xc
add esp, 0x58
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.0040d5e8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx - 0xc]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xd
call fcn.00401900
push 0
push 0x1002
push eax
lea ecx, [ebp - 0x40]
call fcn.0040d9e7
mov edx, dword [ebp - 0x14]
mov esi, dword [edx - 0xc]
push esi
lea ecx, [ebp - 0x14]
call fcn.00401900
push esi
push eax
lea ecx, [ebp - 0x40]
call fcn.0040d31e
lea ecx, [ebp - 0x40]
call fcn.0040d582
mov eax, dword [ebp - 0x20]
push 1
push eax
push str.ClearShell
call fcn.0040c4a0
add esp, 0xc
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.0040d6c3
lea ecx, [ebp - 0x28]
call fcn.00401020
lea ecx, [ebp - 0x14]
call fcn.00401020
lea ecx, [ebp - 0x18]
call fcn.00401020
lea ecx, [ebp - 0x1c]
call fcn.00401020
push 0x34
push 0x44fa80
push 0x44fa48
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4046c8
push 0
push 0
push str._r__t_5
push str.shutdown.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x20]
call fcn.00401020
jmp 0x4047d1
mov ecx, 0x44fa28
mov eax, esi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404760
test dl, dl
je 0x40475c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404760
add eax, 2
add ecx, 2
test dl, dl
jne 0x404740
xor eax, eax
jmp 0x404765
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40477f
cmp edi, 4
jl 0x4047d1
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x4047d1
mov ecx, esi
mov eax, str._run_as_common_user
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4047a6
test dl, dl
je 0x4047a2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4047a6
add eax, 2
add ecx, 2
test dl, dl
jne 0x404786
xor eax, eax
jmp 0x4047ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4047c3
cmp edi, 2
jle 0x4047c3
add ebx, 8
add edi, 0xfffffffe
push ebx
push edi
call fcn.0040bc70
jmp 0x4047ce
mov eax, dword [ebp - 0x28]
push eax
dec edi
push edi
call fcn.00403600
add esp, 8
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4047f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.00430e9b
add ebp, 0x120
mov esp, ebp
pop ebp
ret