Function at 0x455ccc
Capabilities:
Contain obfuscated stackstrings
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa80
push ebx
push esi
push edi
mov dword [ebp - 0x360], ecx
mov dword [ebp - 0x35c], edx
mov dword [ebp - 0x358], eax
mov eax, 0x79482c
call fcn.0074df70
mov byte [ebp - 0x361], 0
xor edx, edx
mov dword [ebp - 0x368], edx
cmp dword [ebp - 0x35c], 0
jne 0x455d20
xor eax, eax
mov edx, dword [ebp - 0x354]
mov dword fs:[0], edx
jmp 0x456b54
xor ecx, ecx
mov dword [ebp - 0x36c], ecx
mov word [ebp - 0x344], 0xc
lea eax, [ebp - 4]
call fcn.00453790
add dword [ebp - 0x338], 2
mov word [ebp - 0x344], 0x18
mov word [ebp - 0x344], 0x24
lea eax, [ebp - 8]
call fcn.00453790
add dword [ebp - 0x338], 2
mov word [ebp - 0x344], 0x18
mov word [ebp - 0x344], 0x30
lea eax, [ebp - 0xc]
call fcn.00453790
add dword [ebp - 0x338], 2
mov word [ebp - 0x344], 0x18
mov word [ebp - 0x344], 0x3c
lea eax, [ebp - 0x268]
call fcn.00453ed4
inc dword [ebp - 0x338]
inc dword [ebp - 0x338]
mov word [ebp - 0x344], 0x18
mov dword [ebp - 0x374], 0x3f
mov word [ebp - 0x344], 0x48
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebp - 0x280]
call fcn.004539c4
add dword [ebp - 0x338], 2
mov word [ebp - 0x344], 0x18
mov esi, 0x7924a4
lea edi, [ebp - 0x580]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov word [ebp - 0x344], 0x54
mov word [ebp - 0x344], 0x60
lea eax, [ebp - 0x284]
call fcn.00453790
add dword [ebp - 0x338], 2
mov word [ebp - 0x344], 0x54
mov word [ebp - 0x344], 0x6c
mov word [ebp - 0x344], 0x78
mov edx, str.StartupFolder
lea eax, [ebp - 0x288]
call fcn.004539c4
add dword [ebp - 0x338], 2
lea edx, [ebp - 0x288]
lea eax, [ebp - 0x284]
call fcn.0045381c
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x288]
mov edx, 2
call fcn.004537c8
mov dl, 1
mov eax, dword [0x492bcc]
call fcn.00498728
mov dword [ebp - 0x36c], eax
mov dl, 1
mov eax, dword [sym.StartupControl.exe__Registry_TRegistry_]
call sym.StartupControl.exe__Registry_TRegistry__bctr_qqrv
mov dword [ebp - 0x368], eax
mov ecx, dword [ebp - 0x360]
dec ecx
je 0x455ead
dec ecx
je 0x455f04
jmp 0x455f5b
mov edx, SysReAllocStringLen
mov eax, dword [ebp - 0x368]
call fcn.0075b2bc
mov word [ebp - 0x344], 0x84
mov edx, 0x792ce9
lea eax, [ebp - 0x28c]
call fcn.004539c4
add dword [ebp - 0x338], 2
lea edx, [ebp - 0x28c]
lea eax, [ebp - 0xc]
call fcn.0045381c
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x28c]
mov edx, 2
call fcn.004537c8
jmp 0x455f71
mov edx, SysStringLen
mov eax, dword [ebp - 0x368]
call fcn.0075b2bc
mov word [ebp - 0x344], 0x90
mov edx, 0x792cf1
lea eax, [ebp - 0x290]
call fcn.004539c4
add dword [ebp - 0x338], 2
lea edx, [ebp - 0x290]
lea eax, [ebp - 0xc]
call fcn.0045381c
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x290]
mov edx, 2
call fcn.004537c8
jmp 0x455f71
push 0x54
lea ecx, [ebp - 0x354]
push ecx
call fcn.0075ab48
add esp, 8
jmp 0x456a2f
mov byte [ebp - 0x375], 0
mov word [ebp - 0x344], 0x6c
mov eax, dword [ebp - 0x358]
cmp byte [eax + 0x742], 0
je 0x455fed
mov edx, dword [ebp - 0x368]
cmp dword [edx + 8], 0x80000002
jne 0x455fed
mov word [ebp - 0x344], 0x9c
mov edx, 0x79243c
lea eax, [ebp - 0x294]
call fcn.004547c0
mov edx, eax
inc dword [ebp - 0x338]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 0x368]
call sym.StartupControl.exe__Registry_TRegistry_OpenKey64_qqrx20System_UnicodeStringo
mov byte [ebp - 0x375], al
dec dword [ebp - 0x338]
lea eax, [ebp - 0x294]
mov edx, 2
call fcn.0075c648
jmp 0x456039
mov word [ebp - 0x344], 0xa8
mov edx, 0x79243c
lea eax, [ebp - 0x298]
call fcn.004547c0
mov edx, eax
inc dword [ebp - 0x338]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 0x368]
call sym.StartupControl.exe__Registry_TRegistry_OpenKey_qqrx20System_UnicodeStringo
mov byte [ebp - 0x375], al
dec dword [ebp - 0x338]
lea eax, [ebp - 0x298]
mov edx, 2
call fcn.0075c648
cmp byte [ebp - 0x375], 0
je 0x4560f9
mov word [ebp - 0x344], 0xb4
lea eax, [ebp - 0x2a0]
call fcn.00453ed4
push eax
inc dword [ebp - 0x338]
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x29c]
call fcn.004547c0
mov edx, eax
inc dword [ebp - 0x338]
mov edx, dword [edx]
mov eax, dword [ebp - 0x368]
pop ecx
call sym.StartupControl.exe__Registry_TRegistry_ReadString_qqrx20System_UnicodeString
lea edx, [ebp - 0x2a0]
lea eax, [ebp - 0x2a4]
call fcn.00453e94
add dword [ebp - 0x338], 2
lea edx, [ebp - 0x2a4]
lea eax, [ebp - 8]
call fcn.0045381c
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2a4]
mov edx, 2
call fcn.004537c8
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2a0]
mov edx, 2
call fcn.0075c648
dec dword [ebp - 0x338]
lea eax, [ebp - 0x29c]
mov edx, 2
call fcn.0075c648
mov eax, dword [ebp - 0x368]
call sym.StartupControl.exe__Registry_TRegistry_CloseKey_qqrv
lea eax, [ebp - 8]
call fcn.00454d64
test al, al
je 0x456283
mov edx, dword [ebp - 0x358]
cmp byte [edx + 0x742], 0
je 0x456176
mov ecx, dword [ebp - 0x368]
cmp dword [ecx + 8], 0x80000002
jne 0x456176
mov word [ebp - 0x344], 0xc0
lea edx, [ebp - 0x280]
lea eax, [ebp - 0x2a8]
call fcn.004547c0
mov edx, eax
inc dword [ebp - 0x338]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 0x368]
call sym.StartupControl.exe__Registry_TRegistry_OpenKey64_qqrx20System_UnicodeStringo
mov byte [ebp - 0x375], al
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2a8]
mov edx, 2
call fcn.0075c648
jmp 0x4561c3
mov word [ebp - 0x344], 0xcc
lea edx, [ebp - 0x280]
lea eax, [ebp - 0x2ac]
call fcn.004547c0
mov edx, eax
inc dword [ebp - 0x338]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 0x368]
call sym.StartupControl.exe__Registry_TRegistry_OpenKey_qqrx20System_UnicodeStringo
mov byte [ebp - 0x375], al
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2ac]
mov edx, 2
call fcn.0075c648
cmp byte [ebp - 0x375], 0
je 0x456283
mov word [ebp - 0x344], 0xd8
lea eax, [ebp - 0x2b4]
call fcn.00453ed4
push eax
inc dword [ebp - 0x338]
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x2b0]
call fcn.004547c0
mov edx, eax
inc dword [ebp - 0x338]
mov edx, dword [edx]
mov eax, dword [ebp - 0x368]
pop ecx
call sym.StartupControl.exe__Registry_TRegistry_ReadString_qqrx20System_UnicodeString
lea edx, [ebp - 0x2b4]
lea eax, [ebp - 0x2b8]
call fcn.00453e94
add dword [ebp - 0x338], 2
lea edx, [ebp - 0x2b8]
lea eax, [ebp - 8]
call fcn.0045381c
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2b8]
mov edx, 2
call fcn.004537c8
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2b4]
mov edx, 2
call fcn.0075c648
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2b0]
mov edx, 2
call fcn.0075c648
mov eax, dword [ebp - 0x368]
call sym.StartupControl.exe__Registry_TRegistry_CloseKey_qqrv
push 0x208
lea edx, [ebp - 0x580]
push edx
lea eax, [ebp - 8]
call fcn.00453ce0
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x4562e3
mov word [ebp - 0x344], 0xe4
lea edx, [ebp - 0x580]
lea eax, [ebp - 0x2bc]
call fcn.004539c4
mov edx, eax
add dword [ebp - 0x338], 2
lea eax, [ebp - 8]
call fcn.0045381c
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2bc]
mov edx, 2
call fcn.004537c8
mov word [ebp - 0x344], 0xf0
lea eax, [ebp - 0x2c0]
call fcn.00453790
push eax
add dword [ebp - 0x338], 2
lea eax, [ebp - 8]
call fcn.00453fa4
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 1
call fcn.00454564
lea edx, [ebp - 0x2c0]
push edx
mov edx, 0x792d00
lea eax, [ebp - 0x2c4]
call fcn.004539c4
add dword [ebp - 0x338], 2
lea edx, [ebp - 0x2c4]
pop eax
call fcn.00456b5c
push eax
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2c4]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2c0]
mov edx, 2
call fcn.004537c8
pop ecx
test cl, cl
je 0x456376
jmp 0x4563f4
mov word [ebp - 0x344], 0xfc
lea eax, [ebp - 0x2cc]
call fcn.00453790
push eax
add dword [ebp - 0x338], 2
mov edx, 0x792d02
lea eax, [ebp - 0x2c8]
call fcn.004539c4
add dword [ebp - 0x338], 2
lea edx, [ebp - 0x2c8]
lea eax, [ebp - 8]
pop ecx
call fcn.00453d6c
lea edx, [ebp - 0x2cc]
lea eax, [ebp - 8]
call fcn.0045381c
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2cc]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2c8]
mov edx, 2
call fcn.004537c8
mov word [ebp - 0x344], 0x108
lea eax, [ebp - 0x2d4]
call fcn.00453790
push eax
add dword [ebp - 0x338], 2
mov edx, 0x792d04
lea eax, [ebp - 0x2d0]
call fcn.004539c4
add dword [ebp - 0x338], 2
lea edx, [ebp - 0x2d0]
lea eax, [ebp - 8]
pop ecx
call fcn.00453d6c
lea edx, [ebp - 0x2d4]
lea eax, [ebp - 4]
call fcn.0045381c
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2d4]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2d0]
mov edx, 2
call fcn.004537c8
mov word [ebp - 0x344], 0x114
lea edx, [ebp - 4]
lea eax, [ebp - 0x2d8]
call fcn.004547c0
inc dword [ebp - 0x338]
mov eax, dword [eax]
lea ecx, [ebp - 0x27c]
mov edx, dword [ebp - 0x374]
call fcn.004ab690
test eax, eax
sete al
and eax, 1
push eax
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2d8]
mov edx, 2
call fcn.0075c648
pop ecx
test cl, cl
je 0x456a0f
cmp dword [ebp - 0x26c], 0x10
je 0x4569a1
mov word [ebp - 0x344], 0x120
mov edx, 0x792d08
lea eax, [ebp - 0x2dc]
call fcn.0075c45c
inc dword [ebp - 0x338]
lea edx, [ebp - 0x2dc]
lea eax, [ebp - 0x268]
call fcn.0075c714
test al, al
je 0x456556
mov edx, 0x792d0a
lea eax, [ebp - 0x2e0]
call fcn.0075c45c
inc dword [ebp - 0x338]
lea edx, [ebp - 0x2e0]
lea eax, [ebp - 0x268]
call fcn.0075c714
test al, al
setne cl
and ecx, 1
push ecx
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2e0]
mov edx, 2
call fcn.0075c648
pop ecx
test ecx, ecx
jne 0x45655a
xor eax, eax
jmp 0x45655f
mov eax, 1
push eax
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2dc]
mov edx, 2
call fcn.0075c648
pop ecx
test cl, cl
je 0x4569a1
mov word [ebp - 0x344], 0x12c
lea eax, [ebp - 0x2e4]
call fcn.00453ed4
mov edx, eax
inc dword [ebp - 0x338]
lea eax, [ebp - 0x268]
call fcn.0075c96c
lea edx, [ebp - 0x2e4]
push edx
mov edx, str.DESKTOP.INI
lea eax, [ebp - 0x2e8]
call fcn.0075c45c
inc dword [ebp - 0x338]
lea edx, [ebp - 0x2e8]
pop eax
call fcn.0075c714
push eax
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2e8]
mov edx, 2
call fcn.0075c648
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2e4]
mov edx, 2
call fcn.0075c648
pop ecx
test cl, cl
je 0x4569a1
mov word [ebp - 0x344], 0x144
lea edx, [ebp - 0x268]
lea eax, [ebp - 0x2ec]
call fcn.00453e94
add dword [ebp - 0x338], 2
mov word [ebp - 0x344], 0x138
mov word [ebp - 0x344], 0x150
lea eax, [ebp - 0x2f4]
call fcn.00453ed4
push eax
inc dword [ebp - 0x338]
lea edx, [ebp - 0x2ec]
lea eax, [ebp - 0x2f0]
call fcn.004547c0
inc dword [ebp - 0x338]
mov eax, dword [eax]
pop edx
call fcn.004ab9e4
lea ecx, [ebp - 0x2f4]
push ecx
mov edx, 0x792d19
lea eax, [ebp - 0x2f8]
call fcn.0075c45c
inc dword [ebp - 0x338]
lea edx, [ebp - 0x2f8]
pop eax
call fcn.0075c8d4
test eax, eax
setg cl
and ecx, 1
push ecx
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2f8]
mov edx, 2
call fcn.0075c648
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2f4]
mov edx, 2
call fcn.0075c648
dec dword [ebp - 0x338]
lea eax, [ebp - 0x2f0]
mov edx, 2
call fcn.0075c648
pop ecx
test cl, cl
je 0x45674c
mov word [ebp - 0x344], 0x168
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2fc]
or ecx, 0xffffffff
call fcn.00456b78
add dword [ebp - 0x338], 2
mov word [ebp - 0x344], 0x15c
lea eax, [ebp - 0x2fc]
call fcn.00454d64
test al, al
jne 0x45672c
lea edx, [ebp - 0x2fc]
lea eax, [ebp - 0x2ec]
call fcn.0045381c
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2fc]
mov edx, 2
call fcn.004537c8
mov word [ebp - 0x344], 0x138
mov word [ebp - 0x344], 0x174
lea eax, [ebp - 0x308]
call fcn.00453ed4
push eax
inc dword [ebp - 0x338]
mov edx, 0x792d27
lea eax, [ebp - 0x304]
call fcn.0075c45c
inc dword [ebp - 0x338]
push dword [eax]
lea edx, [ebp - 0x2ec]
lea eax, [ebp - 0x300]
call fcn.004547c0
inc dword [ebp - 0x338]
mov eax, dword [eax]
pop edx
pop ecx
call fcn.004ab8d4
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x30c]
call fcn.00453ed4
mov ecx, eax
inc dword [ebp - 0x338]
mov eax, 0x792d1b
pop edx
call fcn.0075cc18
lea edx, [ebp - 0x30c]
mov edx, dword [edx]
mov eax, dword [ebp - 0x35c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x338]
lea eax, [ebp - 0x30c]
mov edx, 2
call fcn.0075c648
dec dword [ebp - 0x338]
lea eax, [ebp - 0x308]
mov edx, 2
call fcn.0075c648
dec dword [ebp - 0x338]
lea eax, [ebp - 0x304]
mov edx, 2
call fcn.0075c648
dec dword [ebp - 0x338]
lea eax, [ebp - 0x300]
mov edx, 2
call fcn.0075c648
push dword [ebp - 0x2ec]
mov edx, dword [ebp - 0x368]
mov edx, dword [edx + 8]
mov ecx, dword [ebp - 0x284]
mov eax, dword [ebp - 0x358]
call fcn.00459a78
test al, al
je 0x456897
mov word [ebp - 0x344], 0x180
mov edx, 0x792d28
lea eax, [ebp - 0x310]
call fcn.0075c45c
mov edx, eax
inc dword [ebp - 0x338]
mov edx, dword [edx]
mov eax, dword [ebp - 0x35c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x338]
lea eax, [ebp - 0x310]
mov edx, 2
call fcn.0075c648
mov word [ebp - 0x344], 0x18c
lea eax, [ebp - 0x314]
call fcn.00453790
mov ecx, eax
add dword [ebp - 0x338], 2
lea edx, [ebp - 8]
mov eax, 0x792d36
call fcn.00453df0
lea edx, [ebp - 0x314]
push edx
lea eax, [ebp - 0x31c]
call fcn.00453790
push eax
add dword [ebp - 0x338], 2
lea edx, [ebp - 0x268]
lea eax, [ebp - 0x318]
call fcn.00453e94
add dword [ebp - 0x338], 2
lea edx, [ebp - 0x318]
pop ecx
pop eax
call fcn.00453d6c
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x320]
call fcn.004547c0
mov edx, eax
inc dword [ebp - 0x338]
mov edx, dword [edx]
mov eax, dword [ebp - 0x35c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x338]
lea eax, [ebp - 0x320]
mov edx, 2
call fcn.0075c648
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x31c]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x318]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x314]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x2ec]
mov edx, 2
call fcn.004537c8
mov word [ebp - 0x344], 0x6c
mov word [ebp - 0x344], 0x198
mov eax, dword [0x7b9688]
mov eax, dword [eax]
call fcn.005152fc
mov word [ebp - 0x344], 0x6c
jmp 0x4569cf
lea eax, [ebp - 0x27c]
call fcn.004ab6e0
test eax, eax
je 0x4564ca
mov word [ebp - 0x344], 0x1b0
lea eax, [ebp - 0x27c]
call fcn.004ab704
mov word [ebp - 0x344], 0x6c
jmp 0x456a0f
mov byte [ebp - 0x361], 1
mov word [ebp - 0x344], 0x54
jmp 0x456a2f
mov edx, dword [ebp - 0x368]
mov dword [ebp - 0x328], edx
cmp dword [ebp - 0x328], 0
je 0x456a74
mov ecx, dword [ebp - 0x328]
mov eax, dword [ecx]
mov dword [ebp - 0x324], eax
mov word [ebp - 0x344], 0x1ec
mov edx, 3
mov eax, dword [ebp - 0x328]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x344], 0x1d4
mov edx, dword [ebp - 0x36c]
mov dword [ebp - 0x330], edx
cmp dword [ebp - 0x330], 0
je 0x456ab9
mov eax, dword [ebp - 0x330]
mov edx, dword [eax]
mov dword [ebp - 0x32c], edx
mov word [ebp - 0x344], 0x210
mov edx, 3
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x344], 0x1f8
mov al, byte [ebp - 0x361]
push eax
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x284]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0x280]
mov edx, 2
call fcn.004537c8
dec dword [ebp - 0x338]
dec dword [ebp - 0x338]
lea eax, [ebp - 0x268]
mov edx, 2
call fcn.0075c648
sub dword [ebp - 0x338], 2
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x338], 2
lea eax, [ebp - 8]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x338], 2
lea eax, [ebp - 4]
mov edx, 2
call fcn.004537c8
pop eax
mov edx, dword [ebp - 0x354]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret