Function at 0x46696e
Capabilities:
Persist via run registry key

Disassembly:
js 0x4669d3
jo 0x4669e7
dec edi
bound ebp, qword [edx + 0x65]
arpl word [edx + eax], si
add ah, ah
adc byte [eax], al
add al, byte [eax]
or al, byte [ebp + 0x78]
arpl word [ebp + 0x70], sp
je 0x4669cb
jb 0x466990
add byte [edx], al
add byte [edx], dh
add byte [eax], dl
int3
jb 0x466a3f
outsd dx, dword [esi]
jb 0x4669d3
add ecx, eax
adc al, byte [eax]
sbb byte [eax], al
add al, 8
inc eax
add byte [eax], bl
add byte [eax + ecx], al
je 0x466a45
inc esi
add byte [eax], cl
add byte [ebx + edx*2], al
insb byte es:[edi], dx
add al, byte [eax]
add bl, byte [eax + 0x12]
inc eax
add byte [eax + eax], cl
pop eax
adc al, byte [eax]
or al, 0
add ecx, dword [ebp + 0x73]
add al, byte [bx + si]
adc ah, al
adc al, byte [eax]
adc byte [eax], al
add ecx, dword [ecx + 0x49]
inc esp
add al, byte [eax]
add al, cl
adc al, byte [eax]
adc al, 0
add al, 0x68
push edx
jae 0x466a0f
add byte [edx], al
add byte [ecx], ah
adc ah, cl
dec esi
add byte [0x6f727245], al
jb 0x466a20
add ecx, eax
adc al, byte [eax]
sbb al, 0
inc eax
add byte [eax + eax], bl
add eax, 0x40125802
add byte [eax], cl
add byte [ebx], al
dec ebp
jae 0x466a97
add al, byte [eax]
add al, bh
adc byte [eax], al
or al, 0
push es
dec eax
insb byte es:[edi], dx
jo 0x466a88
inc esp
add al, byte [eax]
add bl, byte [eax + 0x12]
inc eax
add byte [eax], dl
add byte [eax], cl
dec eax
insb byte es:[edi], dx
jo 0x466a95
imul ebp, dword [ebp + 2], 0x12e01200
inc eax
add byte [eax + eax], dl
add ecx, dword [ecx + 0x49]
dec ecx
dec ecx
inc esp
add al, byte [eax]
add al, cl
adc al, byte [eax]
sbb byte [eax], al
add al, 0x68
push edx
jae 0x466a70
add byte [edx], al
add byte [eax], al
add byte [eax], al
js 0x466ae0
inc esi
add byte [edi], al
or dl, byte [ebx + eax*2 + 0x6f]
insd dword es:[edi], dx
dec edi
bound ebp, qword [edx + 0x65]
arpl word [esp + ebp*2 + 0x66], si
inc esi
add byte [eax], dh
sbb eax, 0x40
xor byte [0x40], bl
adc dword [ebx + 0x79], edx
jae 0x466b07
insd dword es:[edi], dx
push edi
imul ebp, dword [esi + 0x2e], 0x4f6d6f43
bound ebp, qword [edx]
add byte [eax + eax], al
add al, ah
push 0x46
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x466b56
outsd dx, dword [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
jb 0x466a8e
jo 0x466b32
add byte [eax], cl
add byte [eax], al
inc dword [eax]
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
je 0x466b78
jb 0x466b84
pushfd
adc al, 0
add bh, bh
adc al, 0
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
invalid
outsd dx, dword [esi]
outsb dx, byte [esi]
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
jb 0x466b60
imul eax, dword fs:[esi], 0x13
or dword [ebx + eax*2 + 0x6f], edx
insd dword es:[edi], dx
inc ebx
insb byte es:[edi], dx
popal
jae 0x466be2
je 0x466bdb
inc esi
add byte [edx], al
add byte [eax], al
add byte [eax], al
jl 0x466be5
inc esi
add byte [ebx], al
adc byte [ebx + eax*2 + 0x6c], dl
popal
jae 0x466bf7
dec ecx
outsb dx, byte [esi]
jae 0x466bfc
popal
outsb dx, byte [esi]
arpl word [ecx + 0x6e], bp
add dword [bx + si], eax
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax + 0x6b], bh
inc esi
add byte [edx], cl
arpl word [ecx + 0x49], bp
outsb dx, byte [esi]
je 0x466c07
jb 0x466c12
popal
insb byte es:[edi], dx
adc byte [ebx + 0x69], ah
push ebx
imul ebp, dword [esi + 0x67], 0x6e49656c
jae 0x466c27
popal
outsb dx, byte [esi]
arpl word [ebp + 0xf], sp
arpl word [ecx + 0x4d], bp
jne 0x466c29
je 0x466c28
dec ecx
outsb dx, byte [esi]
jae 0x466c37
popal
outsb dx, byte [esi]
arpl word [ebp + 0x11], sp
push ebx
jns 0x466c3e
je 0x466c32
insd dword es:[edi], dx
push edi
imul ebp, dword [esi + 0x2e], 0x4f6d6f43
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
dec edi
bound ebp, qword [edx + 2]
add byte [eax], al
loopne 0x466c49
add al, ah
imul eax, dword [esi], 3
inc esi
add byte [ebx], al
andps xmm2, xmmword [eax + ebp*2 + 0x72]
popal
push esp
push esp
push 0x64616572
jb 0x466c4c
popal
imul ebp, dword fs:[esi + 0x67], 0x65646f4d
insb byte es:[edi], dx
add dword [eax], eax
add byte [eax], al
add byte [eax + eax], al
add byte [eax], al
fsubr qword [ebx + 0x46]
add byte [eax], al
add ah, bl
imul eax, dword [esi], 8
inc esi
add byte [eax], cl
je 0x466c6e
push ebx
imul ebp, dword [esi + 0x67], 0x740b656c
insd dword es:[edi], dx
inc ecx
or esi, dword [ebp + ebp*2 + 0x41]
jo 0x466c6e
jb 0x466c83
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0x466c1a
je 0x466c83
inc esi
jb 0x466c7e
push es
push es
je 0x466c8a
inc edx
outsd dx, dword [esi]
je 0x466c89
or dword [ebp + ebp*2 + 0x4e], esi
jne 0x466c9c
je 0x466c9b
jb 0x466c8b
popal
insb byte es:[edi], dx
adc dword [ebx + 0x79], edx
jae 0x466ca4
insd dword es:[edi], dx
push edi
imul ebp, dword [esi + 0x2e], 0x4f6d6f43
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
dec edi
bound ebp, qword [edx + 2]
add byte [eax], al
int3
push es
add byte [ebx - 0x47fbdbbc], al
jmp 0x4cf079
inc esp
and al, 4
mov eax, 0x68424e9
add byte [ebx - 0x47fbdbbc], al
jmp 0x4cf0bb
jmp 0x4cefa3
inc esp
and al, 4
mov eax, 0x682e8e9
add byte [ebx - 0x47fbdbbc], al
call 0x8346730a
inc esp
and al, 4
add al, 0xb8
mov eax, 0x682fce9
add ah, cl
int3
jmp 0x4cef8d
add byte [edi + 0x5f00466c], al
xchg dword [esi + eax*2], ebp
pop edi
insb byte es:[edi], dx
inc esi
add byte [ecx + 0x6c], ch
inc esi
add byte [ecx + 0x6c], al
inc esi
add byte [ebx + 0x6c], cl
imul ebp, dword [esi + eax*2], 0x466c41
dec ebx
insb byte es:[edi], dx
inc esi
add byte [ebp + 0x6c], dl
inc esi
add byte [ebx], al
add byte [eax], al
add byte [edi - 0x4b4e694e], cl
add byte [ebx], dh
je 0x4cef92
popal
add byte [eax + eax + 0x6c], ch
add byte [esi], ch
add byte [edx], dh
add byte fs:[esi], ah
add byte [eax], al
add byte [eax], al
push ebp
mov ebp, esp
add byte [ebp - 0x75], dl
in al, dx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4cefac
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4cf322
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4cf2f0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 0x4cf33c
mov edx, 0x4cf354
mov eax, 0x80000001
call 0xff52f667
mov eax, dword [ebp - 4]
mov edx, 0x4cf390
call 0xff4d7080
sete bl
lea eax, [ebp - 4]
push eax
mov ecx, 0x4cf3a0
mov edx, 0x4cf354
mov eax, 0x80000001
call 0xff52f68f
mov eax, dword [ebp - 4]
mov edx, 0x4cf390
call 0xff4d70a8
sete byte [ebp - 0x1d]
lea eax, [ebp - 4]
push eax
mov ecx, 0x4cf3b8
mov edx, 0x4cf354
mov eax, 0x80000001
call 0xff52f6b8
mov eax, dword [ebp - 4]
mov edx, 0x4cf390
call 0xff4d70d1
sete byte [ebp - 0x1e]
lea eax, [ebp - 8]
mov edx, 0x4cf3d0
call 0xff4d62e2
mov eax, ebx
or al, byte [ebp - 0x1d]
jne 0x4cf06b
cmp byte [ebp - 0x1e], 0
je 0x4cf298
xor eax, eax
call 0xff548ce2
push 0x4cf408
mov eax, dword [0x4efb88]
push dword [eax]
push 0x4cf418
lea eax, [ebp - 0x2c]
mov edx, 3
call 0xff4d7068
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x4cf438
mov eax, 0x80000001
call 0xff52f59a
call 0xff548c1f
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4cf291
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call 0xff59bb8c
push 0x4cf4a4
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4cf544
mov edx, 0x4cf570
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0x80]
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call 0xff5495b8
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x14]
call 0xff4d6383
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call 0xff59c9cd
or edx, 0xffffffff
mov eax, 0x4cf58c
call 0xff52c8de
mov esi, eax
test esi, esi
jle 0x4cf12c
sti
dec esi
add bh, bh
xor byte [eax + 0x18], ch
hlt
and byte [ebp - 0x37170bbb], cl
retf 0xff0c
mov eax, 0x4cf58c
call 0xff5727aa
test al, al
je 0x4cf12c
xor esi, esi
test esi, esi
jg 0x4cf27b
lea eax, [ebp - 0x10]
mov ecx, 0x4cf5b0
mov edx, dword [ebp - 0xc]
call 0xff4d7094
mov eax, dword [ebp - 0x10]
call 0xff53d7b4
test al, al
je 0x4cf22d
mov dl, 1
mov eax, dword [0x439860]
call 0xff5134e4
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x4cf226
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x68]
cmp byte [ebp - 0x1d], 0
je 0x4cf1d5
push 0x4cf5d0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4cf660
mov edx, 0x4cf570
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
call dword [esi + 0x80]
cmp dword [ebp - 0x18], 0
je 0x4cf1bf
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
call fcn.0047b0c8
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x18]
call fcn.00407e88
cmp dword [ebp - 0x18], 0
je 0x4cf1d5
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov eax, 0x4cf688
call 0xff59cc95
test bl, bl
je 0x4cf1ef
cmp dword [ebp - 0x1c], 0
je 0x4cf1ef
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov eax, 0x4cf6c8
call 0xff59ccaf
cmp byte [ebp - 0x1e], 0
je 0x4cf1fd
mov eax, dword [ebp - 0x28]
call 0xff59ceb1
mov eax, dword [ebp - 0x10]
call 0xff53d7bd
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf22d
mov eax, dword [ebp - 0x28]
call 0xff4d4499
ret
mov ecx, dword [ebp - 8]
mov edx, 0x4cf438
mov eax, 0x80000001
call 0xff52fe37
mov ecx, 0x4cf33c
mov edx, 0x4cf354
mov eax, 0x80000001
call 0xff52fe4b
mov ecx, 0x4cf3a0
mov edx, 0x4cf354
mov eax, 0x80000001
call 0xff52fe5f
mov ecx, 0x4cf3b8
mov edx, 0x4cf354
mov eax, 0x80000001
call 0xff52fe73
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf2e6
mov eax, dword [ebp - 0x24]
call 0xff4d4504
ret
mov ecx, dword [ebp - 8]
mov edx, 0x4cf438
mov eax, 0x80000001
call 0xff52fea2
mov ecx, 0x4cf33c
mov edx, 0x4cf354
mov eax, 0x80000001
call 0xff52feb6
mov ecx, 0x4cf3a0
mov edx, 0x4cf354
mov eax, 0x80000001
call 0xff52feca
mov ecx, 0x4cf3b8
mov edx, 0x4cf354
mov eax, 0x80000001
call 0xff52fede
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cf2fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf329
lea eax, [ebp - 0x34]
mov edx, 3
call 0xff4d61d4
lea eax, [ebp - 0x1c]
mov edx, 7
call 0xff4d61e1
ret