Function at 0x406140
Capabilities:
Create process on windows
Delete file
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x43e9e8
push eax
mov eax, 0x1b08
mov dword fs:[0], esp
call fcn.00433d80
push ebx
push ebp
push esi
push edi
push 0x5b
mov ecx, 0x4540c0
call fcn.004011a0
lea eax, [esp + 0x2c4]
push 0x104
push eax
xor ebx, ebx
push str.UPDD_Folder
push ebx
call fcn.00413c6a
mov edi, str.TBSystry.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x1b28]
mov ecx, ebp
and ecx, 3
cmp al, bl
rep movsb byte es:[edi], byte [esi]
je 0x40620c
mov ebp, dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp + 0x68]
push eax
call ebp
lea ecx, [esp + 0x48]
lea edx, [esp + 0x68]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
lea eax, [esp + 0x2e0]
push ebx
push eax
push ebx
mov dword [esp + 0xbc], 1
mov word [esp + 0xc0], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x406212
mov ebp, dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004169cb
test eax, eax
je 0x40628e
mov edi, str.net_start__TBKeyPad_System_Daemon_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [esp + 0x1b28]
and ecx, 3
cmp al, bl
rep movsb byte es:[edi], byte [esi]
je 0x40632c
lea ecx, [esp + 0x68]
push ecx
call ebp
lea edx, [esp + 0x48]
lea eax, [esp + 0x68]
push edx
push eax
push ebx
push ebx
push 0x200
push ebx
push ebx
lea ecx, [esp + 0x2e0]
push ebx
mov dword [esp + 0xb4], 1
mov word [esp + 0xb8], bx
push ecx
jmp 0x406325
call fcn.00408230
test eax, eax
je 0x40632c
lea edx, [esp + 0x2c4]
push 0x104
push edx
push str.UPDD_Folder
push ebx
call fcn.00413c6a
mov edi, str.TBKeyPad.exe__i0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x1b28]
mov ecx, edx
and ecx, 3
cmp al, bl
rep movsb byte es:[edi], byte [esi]
je 0x40632c
lea eax, [esp + 0x68]
push eax
call ebp
lea ecx, [esp + 0x48]
lea edx, [esp + 0x68]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
lea eax, [esp + 0x2e0]
push ebx
mov dword [esp + 0xb4], 1
mov word [esp + 0xb8], bx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 0x44]
push ecx
push str.ExtInSvc
push ebx
call fcn.00413d19
cmp dword [esp + 0x44], ebx
je 0x406405
call fcn.00418537
test eax, eax
je 0x406405
lea edx, [esp + 0xbc]
push 0x104
push edx
push str.UPDD_Folder
push ebx
call fcn.00413c6a
mov edi, str._tbextsvc.exe__i
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xbc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x1b28]
mov ecx, edx
and ecx, 3
cmp al, bl
rep movsb byte es:[edi], byte [esi]
je 0x4063e6
lea eax, [esp + 0x68]
push eax
call ebp
lea ecx, [esp + 0x48]
lea edx, [esp + 0x68]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
lea eax, [esp + 0xd8]
push ebx
push eax
push ebx
mov dword [esp + 0xbc], 1
mov word [esp + 0xc0], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x406405
lea ecx, [esp + 0xbc]
push ecx
push str.tbextsvc
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call fcn.00404d10
add esp, 0x10
lea edx, [esp + 0x40c]
push 0x104
push edx
push str.UPDD_Folder
push ebx
call fcn.00413c6a
mov edi, 0x44a3cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x40c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x44a9b8
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x410]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.PostStup.txt
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x410]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00433c01
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x406868
push ebp
call fcn.00433e11
add esp, 4
test eax, eax
jne 0x406851
push ebp
lea ecx, [esp + 0x618]
push 0x400
push ecx
call fcn.00433daf
push ebp
call fcn.00433e11
add esp, 0x10
test eax, eax
jne 0x406851
lea edx, [esp + 0xbc]
push 0x104
push edx
push str.UPDD_Folder
push ebx
call fcn.00413c6a
mov edi, 0x44a3cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xbc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xb0]
and ecx, 3
push eax
push str.Language
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.00413c6a
lea ecx, [esp + 0x614]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00416cb2
lea edx, [esp + 0xac]
lea ecx, [esp + 0x60]
push edx
mov dword [esp + 0x1b24], ebx
call fcn.00416cb2
push str._LANG_
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1b24], 1
call fcn.00416cb2
lea eax, [esp + 0x60]
lea ecx, [esp + 0x58]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x1b2c], 2
call fcn.00415edb
add esp, 0xc
lea ecx, [esp + 0x58]
mov byte [esp + 0x1b20], 1
call fcn.00416d10
lea ecx, [esp + 0x60]
mov byte [esp + 0x1b20], bl
call fcn.00416d10
lea ecx, [esp + 0x18]
call fcn.00416d15
test eax, eax
je 0x406615
push ebx
lea ecx, [esp + 0x1c]
call fcn.00416d25
cmp byte [eax], 0x2d
jne 0x406615
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push 1
push eax
lea ecx, [esp + 0x24]
call fcn.00417104
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1b24], 3
call fcn.00416d3d
lea ecx, [esp + 0x20]
mov byte [esp + 0x1b20], bl
call fcn.00416d10
lea ecx, [esp + 0x18]
call fcn.00416d31
lea edx, [esp + 0xbc]
mov edi, eax
jmp 0x4066cc
lea ecx, [esp + 0x18]
call fcn.00416d31
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xbc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1000
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xc0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._Bundle
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x4540b0]
mov ecx, edx
and ecx, 3
mov byte [esp + 0xb1c], al
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0xb1d]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb1c]
stosw word es:[edi], ax
push ecx
push str.Installing_Bundle
push 0x4427c4
push 0x80000002
stosb byte es:[edi], al
call fcn.0040bc10
add esp, 0x14
lea edi, [esp + 0xb18]
lea edx, [esp + 0xbc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x3c8]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp byte [esp + 0x1b28], bl
je 0x406777
lea ecx, [esp + 0x48]
lea edx, [esp + 0x3c8]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
lea eax, [esp + 0xd8]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, 0x400
call fcn.00418537
test eax, eax
je 0x406741
mov esi, 0x100400
mov ecx, dword [esp + 0x50]
push ecx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x64
mov ecx, 0x4540c0
mov esi, eax
call fcn.004011a0
push 0x65
mov ecx, 0x4540c0
call fcn.004011a0
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40682c
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
sub esp, 8
mov byte [esp + 0x1b28], 4
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x44a744
call fcn.00416cb2
sub esp, 8
lea edx, [esp + 0x624]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
mov byte [esp + 0x1b34], 5
call fcn.00416cb2
lea eax, [esp + 0x40]
mov byte [esp + 0x1b30], 4
push eax
call fcn.004185a6
add esp, 0x14
lea ecx, [esp + 0xbc]
push ecx
mov ecx, dword [esp + 0x34]
call fcn.00416d31
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call fcn.00404d10
mov esi, dword [esp + 0x40]
add esp, 0x10
cmp esi, ebx
mov byte [esp + 0x1b20], bl
je 0x40682c
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x406823
lea edi, [eax]
mov ecx, esi
call fcn.00416d10
add esi, 8
dec edi
jne 0x406812
mov esi, dword [esp + 0x30]
push esi
call fcn.00433020
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x1b20], 0xffffffff
call fcn.00416d10
push ebp
call fcn.00433e11
add esp, 4
test eax, eax
je 0x4064ad
push ebp
call fcn.00433b53
add esp, 4
lea edx, [esp + 0x40c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x510]
push 0x104
push eax
push str.UPDD_Folder
push ebx
call fcn.00413c6a
or ebp, 0xffffffff
mov edi, 0x44a3cc
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x510]
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x510]
and ecx, 3
push 0x44a9b8
rep movsb byte es:[edi], byte [esi]
mov edi, str.Autorun.txt
mov ecx, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x514]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00433c01
mov esi, eax
add esp, 8
cmp esi, ebx
mov dword [esp + 0x14], esi
je 0x406cd3
mov cl, byte [0x4540b0]
xor eax, eax
mov byte [esp + 0xb18], cl
mov ecx, 0x3ff
lea edi, [esp + 0xb19]
lea edx, [esp + 0xb18]
rep stosd dword es:[edi], eax
push 0x1000
push edx
stosw word es:[edi], ax
push str.Installing_Bundle
push 0x4427c4
push 0x80000002
stosb byte es:[edi], al
call fcn.0040bc10
push esi
call fcn.00433e11
add esp, 0x18
test eax, eax
jne 0x406cca
push esi
lea eax, [esp + 0x618]
push 0x400
push eax
call fcn.00433daf
push esi
call fcn.00433e11
add esp, 0x10
test eax, eax
jne 0x406cca
lea ecx, [esp + 0x614]
push 0xd
push ecx
mov byte [esp + 0x1b], 1
call fcn.00433960
add esp, 8
test eax, eax
je 0x4069ba
lea edx, [esp + 0x614]
push 0xd
push edx
call fcn.00433960
mov byte [eax], bl
lea eax, [esp + 0x61c]
push 0xd
push eax
call fcn.00433960
add esp, 0x10
test eax, eax
jne 0x406993
lea ecx, [esp + 0x614]
push 0xa
push ecx
call fcn.00433960
add esp, 8
test eax, eax
je 0x4069f7
lea edx, [esp + 0x614]
push 0xa
push edx
call fcn.00433960
mov byte [eax], bl
lea eax, [esp + 0x61c]
push 0xa
push eax
call fcn.00433960
add esp, 0x10
test eax, eax
jne 0x4069d0
lea ecx, [esp + 0x614]
push str.NOBUNDLE
push ecx
call fcn.00433c20
add esp, 8
test eax, eax
je 0x406a2b
lea edx, [esp + 0x614]
push str.NOBUNDLE
push edx
call fcn.00433c20
add esp, 8
mov byte [eax], bl
mov byte [esp + 0x13], bl
lea eax, [esp + 0x1c0]
push 0x104
push eax
push str.UPDD_Folder
push ebx
call fcn.00413c6a
mov edi, 0x44a3cc
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0x1c0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1c4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x618]
mov ecx, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1c4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp byte [esp + 0x13], bl
je 0x406b20
mov edi, str._Bundle
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0x1c0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1c0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb18]
mov ecx, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x1b28], bl
je 0x406b6a
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x68]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
lea eax, [esp + 0x1dc]
push ebx
push eax
push ebx
mov dword [esp + 0xbc], 1
mov word [esp + 0xc0], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
sub esp, 8
mov dword [esp + 0x1b28], 6
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x44a744
call fcn.00416cb2
sub esp, 8
lea edx, [esp + 0x624]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x1b34], 7
call fcn.00416cb2
lea eax, [esp + 0x30]
mov byte [esp + 0x1b30], 6
push eax
call fcn.004185a6
add esp, 0x14
lea ecx, [esp + 0x1c0]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00416d31
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00404d10
add esp, 0x10
lea edx, [esp + 0xa14]
push 0x104
push edx
push str.UPDD_Folder
push ebx
call fcn.00413c6a
mov edi, str.uninst.dat
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0xa14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x44a540
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xa18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00433c01
mov esi, eax
push esi
push str.REGHKEY_LOCAL_MACHINE_SOFTWAREMicrosoftWindowsCurrentVersionRun_
call fcn.00433b05
mov ecx, dword [esp + 0x30]
add esp, 0x10
push esi
call fcn.00416d31
push eax
call fcn.00433b05
push esi
push 0x44a4f0
call fcn.00433b05
push esi
call fcn.00433b53
mov eax, dword [esp + 0x34]
add esp, 0x14
mov dword [esp + 0x1b20], ebp
cmp eax, ebx
je 0x406cb1
mov ecx, dword [esp + 0x24]
mov esi, eax
cmp ecx, ebx
je 0x406ca8
lea edi, [ecx]
mov ecx, esi
call fcn.00416d10
add esi, 8
dec edi
jne 0x406c97
mov eax, dword [esp + 0x20]
push eax
call fcn.00433020
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00433e11
mov esi, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x406954
push esi
call fcn.00433b53
add esp, 4
mov ecx, dword [esp + 0x1b18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1b14
ret