Function at 0x40135e
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000004
push 0
push 0xdd9f04
push 1
mov ebx, 0x411780
call fcn.00411326
add esp, 0x10
push 0x80000301
push 0
push 0xa
push 1
mov eax, 2
mov ebx, 0x460170
call fcn.00411338
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 1
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4013d8
mov eax, 0x4acbe5
push eax
push 2
mov ebx, 0x411950
call fcn.00411326
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4013fe
push ebx
call fcn.0041131a
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x401411
mov eax, 0x4acbe5
push eax
push 1
mov ebx, 0x411d70
call fcn.00411326
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x401437
push ebx
call fcn.0041131a
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [0xdd9f08]
test ebx, ebx
je 0x40144e
push ebx
call fcn.0041131a
add esp, 4
pop eax
mov dword [0xdd9f08], eax
push 0xdd9f0c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x14]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4014be
push 1
mov eax, 0x4acc08
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, 0x4acc11
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00401a3c
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40149f
push ebx
call fcn.0041131a
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4014af
push ebx
call fcn.0041131a
add esp, 4
push 0
call fcn.00411350
add esp, 4
jmp 0x401a18
mov eax, 0x4acc36
push eax
mov ebx, dword [0xdd9f10]
test ebx, ebx
je 0x4014d7
push ebx
call fcn.0041131a
add esp, 4
pop eax
mov dword [0xdd9f10], eax
push str.data.dat
push dword [0xdd9ef8]
mov ecx, 2
call fcn.004010dc
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [0xdd9f14]
test ebx, ebx
je 0x40150f
push ebx
call fcn.0041131a
add esp, 4
pop eax
mov dword [0xdd9f14], eax
push str.config.dat
push dword [0xdd9ef8]
mov ecx, 2
call fcn.004010dc
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [0xdd9f18]
test ebx, ebx
je 0x401547
push ebx
call fcn.0041131a
add esp, 4
pop eax
mov dword [0xdd9f18], eax
push 0
mov ebx, 0x4115e0
call fcn.00411326
add esp, 4
mov dword [ebp - 0xc], eax
push 0x4acc50
push dword [ebp - 0xc]
push dword [0xdd9ef8]
push 0x4acc50
mov ecx, 4
call fcn.004010dc
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x401595
push ebx
call fcn.0041131a
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4015a9
push ebx
call fcn.0041131a
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov ebx, dword [0xdd9f04]
call fcn.00401288
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x4016fd
mov ebx, dword [0xdd9f04]
call fcn.004012a1
mov eax, 0
cmp eax, ecx
jl 0x4015e6
push 1
call fcn.0041132c
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0xc], ebx
push str._interface
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call fcn.004012c1
add esp, 8
cmp eax, 0
jne 0x4016fd
call fcn.00401af2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401625
push ebx
call fcn.0041131a
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 1
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0xdd9f0c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40165b
push ebx
call fcn.0041131a
add esp, 4
mov eax, 0x4acbe5
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401671
push ebx
call fcn.0041131a
add esp, 4
pop eax
mov dword [ebp - 8], eax
push str.__run
push dword [ebp - 4]
mov ecx, 2
call fcn.004010dc
add esp, 8
mov dword [ebp - 0xc], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4016a0
mov eax, 0x4acbe5
push eax
push 0x80000004
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunzero
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x4134f0
call fcn.00411326
add esp, 0x28
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4016db
push ebx
call fcn.0041131a
add esp, 4
push 0
push 1
push 0xffffffffffffffff
push 5
push 0x6010000
push 0x52010001
call fcn.00411344
add esp, 0x18
jmp 0x401a18
push 0
push 0
push 0
push 0x80000004
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunzero
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x4134d0
call fcn.00411326
add esp, 0x28
mov dword [ebp - 0xc], eax
push str.__run
push dword [ebp - 4]
mov ecx, 2
call fcn.004010dc
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call fcn.004012c1
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x401775
push ebx
call fcn.0041131a
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x401785
push ebx
call fcn.0041131a
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x4018fd
push 0
push 0
push 0
push 0x80000301
push 0
push 1
push 0x80000004
push 0
push 0x4acc96
push 3
mov ebx, 0x4135c0
call fcn.00411326
add esp, 0x28
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4018ee
call fcn.00401af2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4017e8
push ebx
call fcn.0041131a
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 1
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0xdd9f0c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40181e
push ebx
call fcn.0041131a
add esp, 4
mov eax, 0x4acbe5
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401834
push ebx
call fcn.0041131a
add esp, 4
pop eax
mov dword [ebp - 8], eax
push str.__run
push dword [ebp - 4]
mov ecx, 2
call fcn.004010dc
add esp, 8
mov dword [ebp - 0xc], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x401863
mov eax, 0x4acbe5
push eax
push 0x80000004
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunzero
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x4134f0
call fcn.00411326
add esp, 0x28
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40189e
push ebx
call fcn.0041131a
add esp, 4
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0xdd9f08
push 0xdd9f0c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x48]
push 0x80000002
push 0
push 1
push 0x80000301
push 0
push 2
push 2
mov eax, 2
mov ebx, 0x4602a0
call fcn.00411338
add esp, 0x1c
push 0
call fcn.00411350
add esp, 4
jmp 0x401a18
mov ebx, dword [0xdd9f04]
call fcn.00401288
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jne 0x40191f
push 0xdd9f04
call fcn.00401c91
push 0x80000301
push 0
push 0xb
push 1
mov eax, 2
mov ebx, 0x460170
call fcn.00411338
add esp, 0x10
mov dword [ebp - 0xc], eax
push str.zero_run.bj
push dword [ebp - 0xc]
mov ecx, 2
call fcn.004010dc
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40196d
push ebx
call fcn.0041131a
add esp, 4
push 0x80000301
push 0
push 3
push 0x80000301
push 0
push 5
push 0x80000004
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x401998
mov eax, 0x4acbe5
push eax
push 3
mov ebx, 0x412df0
call fcn.00411326
add esp, 0x28
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4019be
push ebx
call fcn.0041131a
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x401a18
push 0
mov ebx, 0x4115e0
call fcn.00411326
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4019f0
mov eax, 0x4acbe5
push eax
push 1
mov eax, 6
mov ebx, 0x475490
call fcn.00411338
add esp, 0x10
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x401a18
push ebx
call fcn.0041131a
add esp, 4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401a28
push ebx
call fcn.0041131a
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401a38
push ebx
call fcn.0041131a
add esp, 4
mov esp, ebp
pop ebp
ret