Function at 0x414452
Capabilities:
Accept command line arguments
Persist via run registry key

Disassembly:
push 0x98
mov eax, 0x470e48
call fcn.0045d4e7
mov eax, dword [ebp + 8]
mov edi, 0x497a28
push edi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x48], eax
call fcn.004037fc
and dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.0042df63
pop ecx
pop ecx
test al, al
jne 0x4144a4
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00403af7
xor al, al
call fcn.0045d543
ret 4
push dword [ebp - 0x3c]
push str.readding_run_once._Old_Commandline:__s
call fcn.00416edc
pop ecx
pop ecx
lea ecx, [ebp - 0x88]
call fcn.0043dbda
lea ecx, [ebp - 0x88]
call fcn.0043e5c4
lea ecx, [ebp - 0x6c]
call fcn.0042a635
push str._RUNONCE
push str._RODONE
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.00409c47
push str.ADMIN
lea ecx, [ebp - 0x88]
call fcn.0043d201
test al, al
je 0x41451b
push str.removing_ADMIN_switch
call fcn.00416edc
pop ecx
mov ebx, 0x481518
push ebx
push str._ADMIN
lea ecx, [ebp - 0x3c]
call fcn.00409c47
jmp 0x414520
mov ebx, 0x481518
push edi
lea ecx, [ebp - 0x40]
call fcn.004037fc
mov esi, str.PATH
push esi
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 4
call fcn.0043d201
test al, al
je 0x41457c
push esi
lea ecx, [ebp - 0x88]
call fcn.0043e5fb
push eax
push esi
lea eax, [ebp - 0x40]
push str.___s___s_
push eax
call fcn.0042dc91
add esp, 0x10
test al, al
je 0x41457c
push str.removing_PATH_switch
call fcn.00416edc
pop ecx
push ebx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x3c]
call fcn.00409c47
mov esi, str.MEDIA
push esi
lea ecx, [ebp - 0x88]
call fcn.0043d201
test al, al
je 0x4145cb
push esi
lea ecx, [ebp - 0x88]
call fcn.0043e5fb
push eax
push esi
lea eax, [ebp - 0x40]
push str.___s___s_
push eax
call fcn.0042dc91
add esp, 0x10
test al, al
je 0x4145cb
push str.removing_MEDIA_switch
call fcn.00416edc
pop ecx
push ebx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x3c]
call fcn.00409c47
push edi
lea ecx, [ebp - 0x44]
call fcn.004037fc
mov ecx, dword [ebp - 0x48]
add ecx, 0x5c
mov byte [ebp - 4], 5
call fcn.0043112d
push eax
lea eax, [ebp - 0x44]
push str.__s_
push eax
call fcn.0042dc91
add esp, 0xc
test al, al
je 0x41461c
push str.removing_extra_commands_at_the_beginning.
call fcn.00416edc
pop ecx
push ebx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x3c]
call fcn.00409c47
push dword [ebp - 0x44]
lea eax, [ebp - 0x3c]
push eax
call fcn.004149cd
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00403af7
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00403af7
lea ecx, [ebp - 0x6c]
call fcn.0042a5f3
test al, al
je 0x41473c
lea ecx, [ebp - 0x6c]
call fcn.0042a615
lea ecx, [ebp - 0x88]
call fcn.0043dbef
jmp 0x41448f
lea esi, [ebp - 0x9c]
call fcn.00408f08
push 0
call fcn.0042c3d1
pop ecx
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
test al, al
jne 0x41475d
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 1
push 0xf003f
mov edi, reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x9c]
call fcn.0041b076
test eax, eax
jne 0x4147da
mov ecx, esi
call fcn.004396ac
test eax, eax
jle 0x41478d
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_to_open_runonce__0x_08x
call fcn.00416f04
xor bl, bl
pop ecx
pop ecx
mov ecx, dword [ebp - 0x90]
add ecx, 0xfffffff0
call fcn.00403af7
lea ecx, [ebp - 0x9c]
call fcn.00439949
lea ecx, [ebp - 0x6c]
call fcn.0042a615
lea ecx, [ebp - 0x88]
call fcn.0043dbef
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00403af7
mov al, bl
jmp 0x41449c
mov esi, str.PRODID
push esi
lea ecx, [ebp - 0x88]
call fcn.0043e5fb
test eax, eax
je 0x414823
lea eax, [ebp - 0x3c]
push eax
push esi
lea ecx, [ebp - 0x88]
call fcn.0043e5fb
push eax
lea ecx, [ebp - 0x9c]
call fcn.00439dad
test eax, eax
je 0x414823
push dword [ebp - 0x3c]
push str.writing_new_commandline__s_to_run_key
call fcn.00416edc
mov bl, 1
jmp 0x41479a
xor bl, bl
jmp 0x41479c