Function at 0x4059c4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
mov dword [ebp - 0x68], eax
mov eax, 0x4f3c10
call fcn.004d37cc
mov dl, 1
mov eax, dword [0x452014]
call fcn.004038a8
mov dword [ebp - 0x6c], eax
mov word [ebp - 0x54], 8
lea eax, [ebp - 4]
call fcn.00401d48
mov ecx, eax
inc dword [ebp - 0x48]
mov edx, dword [ebp - 0x68]
add edx, 0x33c
mov eax, str.CD__D
call fcn.004dde98
lea edx, [ebp - 4]
mov edx, dword [edx]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x48]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004dda3c
mov word [ebp - 0x54], 0x14
mov edx, str.IF_EXIST_DnPatch.ex___
lea eax, [ebp - 8]
call fcn.004dd894
inc dword [ebp - 0x48]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x48]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004dda3c
mov word [ebp - 0x54], 0x20
mov edx, str.__DEL__F_DnPatch.exe
lea eax, [ebp - 0xc]
call fcn.004dd894
inc dword [ebp - 0x48]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x48]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004dda3c
mov word [ebp - 0x54], 0x2c
mov edx, str.__REN_DnPatch.ex__DnPatch.exe
lea eax, [ebp - 0x10]
call fcn.004dd894
inc dword [ebp - 0x48]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x48]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004dda3c
mov word [ebp - 0x54], 0x38
mov edx, 0x4f362b
lea eax, [ebp - 0x14]
call fcn.004dd894
inc dword [ebp - 0x48]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x48]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004dda3c
mov word [ebp - 0x54], 0x44
mov edx, str.DEL_PATCHONE.BAT
lea eax, [ebp - 0x18]
call fcn.004dd894
inc dword [ebp - 0x48]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0x48]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004dda3c
mov word [ebp - 0x54], 0x50
lea eax, [ebp - 0x20]
call fcn.00401d48
push eax
inc dword [ebp - 0x48]
mov edx, 0x4f363e
lea eax, [ebp - 0x1c]
call fcn.004dd894
inc dword [ebp - 0x48]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x68]
add eax, 0x33c
pop ecx
call fcn.004dda94
lea edx, [ebp - 0x20]
mov edx, dword [edx]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
call dword [ecx + 0x74]
dec dword [ebp - 0x48]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004dda3c
dec dword [ebp - 0x48]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004dda3c
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
je 0x405ba6
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov dword [ebp - 0x24], edx
mov word [ebp - 0x54], 0x68
mov edx, 3
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x54], 0x5c
mov dl, 1
mov eax, dword [0x45e9dc]
call fcn.0045eadc
mov dword [ebp - 0x70], eax
mov edx, SysFreeString
mov eax, dword [ebp - 0x70]
call fcn.004dd800
mov word [ebp - 0x54], 0x74
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
lea eax, [ebp - 0x2c]
call fcn.004dd894
inc dword [ebp - 0x48]
mov edx, dword [eax]
mov cl, 1
mov eax, dword [ebp - 0x70]
call fcn.0045ecf8
dec dword [ebp - 0x48]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004dda3c
lea eax, [ebp - 0x38]
call fcn.00401d48
push eax
inc dword [ebp - 0x48]
mov edx, str.PATCHONE.BAT
lea eax, [ebp - 0x34]
call fcn.004dd894
inc dword [ebp - 0x48]
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x68]
add eax, 0x33c
pop ecx
call fcn.004dda94
lea edx, [ebp - 0x38]
push dword [edx]
mov word [ebp - 0x54], 0x80
mov edx, str.PATCHONE
lea eax, [ebp - 0x30]
call fcn.004dd894
inc dword [ebp - 0x48]
mov edx, dword [eax]
mov eax, dword [ebp - 0x70]
pop ecx
call fcn.0045f17c
dec dword [ebp - 0x48]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004dda3c
dec dword [ebp - 0x48]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.004dda3c
dec dword [ebp - 0x48]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004dda3c
mov eax, dword [ebp - 0x70]
call fcn.0045eb88
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 0
je 0x405cac
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx]
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x54], 0x98
mov edx, 3
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x54], 0x8c
mov edx, dword [ebp - 0x64]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret