Function at 0x40d3eb
Capabilities:
Accept command line arguments
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
mov eax, 0x4285f5
call fcn.0041eb94
sub esp, 0x1f4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor ebx, ebx
mov dword [ebp + 0x10], eax
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp + 8]
mov eax, 0x434ec8
mov dword [0x434f38], 0x432e58
mov dword [0x434e60], eax
push 0x432dc8
push eax
mov dword [0x434ec8], 0x84
mov dword [0x434f2c], 0x300
call fcn.0040f11f
mov eax, 0x42a618
mov ecx, eax
test ecx, ecx
je 0x40d464
push 0x10
push eax
push 0x434eb8
call fcn.0041ec40
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, 0x432ff0
lea edi, [ebp - 0x28]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 1
mov dword [0x434f4c], eax
pop edi
lea eax, [ebp - 0x28]
push eax
xor esi, esi
push dword [ebp + 0x10]
call fcn.0040d329
pop ecx
mov dword [ebp + 8], eax
pop ecx
cmp dword [ebp + 8], ebx
je 0x40de67
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004032bb
pop ecx
mov dword [ebp - 0x5c], eax
pop ecx
lea eax, [ebp - 0x5c]
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 4], ebx
call fcn.004087df
push dword [ebp - 0x5c]
mov byte [ebp - 4], 2
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push str.UnregServer
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40d4ef
push ebx
push ebx
mov esi, 0x434ec8
push 0x64
push esi
call fcn.0040defa
push ebx
push edi
push esi
call fcn.0040f49c
jmp 0x40d518
push str.RegServer
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40d51f
push ebx
push edi
mov esi, 0x434ec8
push 0x64
push esi
call fcn.0040defa
push ebx
push edi
push esi
call fcn.0040f323
mov esi, eax
jmp 0x40de34
cmp word [0x432fd0], bx
mov ecx, 0x432fd0
mov eax, ecx
je 0x40d536
inc eax
inc eax
cmp word [eax], bx
jne 0x40d52f
sub eax, ecx
push ebx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040a3cc
test eax, eax
jne 0x40d5d3
push ebx
push edi
mov esi, 0x434ec8
push 0x64
push esi
call fcn.0040defa
push ebx
push edi
push esi
call fcn.0040f323
lea ecx, [ebp + 0x13]
call fcn.0041a942
push dword [0x42a4d4]
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x24]
mov byte [0x434fc8], bl
push 2
push eax
mov byte [0x434fcc], 1
call fcn.0040f960
push ebx
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 3
call fcn.0040fab8
push dword [ebp - 0x60]
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 4
push eax
call fcn.0040504f
mov esi, eax
lea ecx, [ebp - 0x1bc]
and esi, 0xffff
mov byte [ebp - 4], 3
call fcn.004104a3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c]
jmp 0x40de2f
cmp word [0x432fc8], bx
mov ecx, 0x432fc8
mov eax, ecx
je 0x40d5ea
inc eax
inc eax
cmp word [eax], bx
jne 0x40d5e3
sub eax, ecx
push ebx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040a3cc
test eax, eax
jne 0x40d6e2
push ebx
push edi
mov esi, 0x434ec8
push 0x64
push esi
call fcn.0040defa
push ebx
push edi
push esi
call fcn.0040f323
lea ecx, [ebp + 0x13]
mov esi, eax
call fcn.0041a942
push dword [0x42a4d4]
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x24]
mov byte [0x434fc8], bl
push 0x28
push eax
mov byte [0x434fcc], 1
call fcn.0040f960
push 0x26
lea eax, [ebp - 0x6c]
push 2
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.0040f960
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 6
call fcn.0040cb2c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x34]
call fcn.0040d329
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x40d6ca
push ebx
lea ecx, [ebp - 0x1bc]
call fcn.0040fab8
inc edi
lea ecx, [ebp - 0x58]
push edi
mov byte [ebp - 4], 7
call fcn.00408810
push dword [eax + 0xc]
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 8
push dword [ebp - 0x60]
push eax
call fcn.00406272
mov esi, eax
lea ecx, [ebp - 0x58]
and esi, 0xffff
mov byte [ebp - 4], 7
call fcn.0040886d
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 6
call fcn.004104a3
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 5
call fcn.0040886d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
jmp 0x40de2f
cmp word [0x432fc0], bx
mov ecx, 0x432fc0
mov eax, ecx
je 0x40d6f9
inc eax
inc eax
cmp word [eax], bx
jne 0x40d6f2
sub eax, ecx
push ebx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040a3cc
test eax, eax
jne 0x40db5d
push ebx
push edi
mov edi, 0x434ec8
push 0x64
push edi
call fcn.0040defa
push ebx
push 1
push edi
call fcn.0040f323
lea ecx, [ebp + 0xb]
mov esi, eax
call fcn.0041a942
push dword [0x42a4d4]
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x24]
mov byte [0x434fc8], 1
push 0x28
push eax
mov byte [0x434fcc], 1
call fcn.0040f960
push 0x26
lea eax, [ebp - 0x58]
push 2
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 9
call fcn.0040f960
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
call fcn.0040cb2c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x68]
call fcn.0040d329
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], 8
je 0x40d7f6
push str.AppStart
push eax
call fcn.0040d36a
pop ecx
cmp al, 1
pop ecx
jne 0x40d7a8
mov dword [ebp - 0x14], 1
push str.EndOfInstall
push dword [ebp + 8]
call fcn.0040d36a
pop ecx
cmp al, 1
pop ecx
jne 0x40d7c2
mov dword [ebp - 0x14], 4
push str.AppMenu
push dword [ebp + 8]
call fcn.0040d36a
pop ecx
cmp al, 1
pop ecx
jne 0x40d7dc
mov dword [ebp - 0x14], 8
push str.BeginInstall
push dword [ebp + 8]
call fcn.0040d36a
pop ecx
cmp al, 1
pop ecx
jne 0x40d7f6
mov dword [ebp - 0x14], 0x10
push str._afterreboot
push dword [ebp + 8]
call fcn.0040d36a
pop ecx
cmp al, 1
pop ecx
jne 0x40d959
push dword [ebp + 0x10]
lea ecx, [ebp - 0x38]
call fcn.00408810
push str._afterreboot
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xb
call fcn.00408810
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xc
call fcn.0040a436
cmp dword [ebp - 0x8c], ebx
jne 0x40d844
xor eax, eax
jmp 0x40d850
push dword [ebp - 0x8c]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push ebx
push eax
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x38]
call fcn.0040a3cc
push eax
lea eax, [ebp - 0x48]
push ebx
push eax
lea ecx, [ebp - 0x38]
call fcn.0040f960
cmp dword [ebp - 0x3c], ebx
mov byte [ebp - 4], 0xd
jne 0x40d87b
xor eax, eax
jmp 0x40d884
push dword [ebp - 0x3c]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
inc eax
push eax
call fcn.0041f2b0
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
pop ecx
mov dword [ebp - 0x14], eax
jne 0x40d89d
xor edi, edi
jmp 0x40d8cc
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp + 8], eax
add eax, 3
and al, 0xfc
call fcn.0041ebc0
mov edi, esp
push ebx
push ebx
push dword [ebp + 8]
mov byte [edi], bl
push edi
push 0xffffffffffffffff
push dword [ebp - 0x14]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x1fc]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x200], 0x44
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x200]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40d921
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 0x10]
call fcn.0041ba99
pop ecx
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0xd
call fcn.0040f834
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xc
call fcn.0040886d
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xb
call fcn.0040886d
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x38]
call fcn.0040886d
jmp 0x40db45
push str._reboot
push dword [ebp + 8]
call fcn.0040d36a
pop ecx
cmp al, 1
pop ecx
jne 0x40da8f
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], 0x42a3b8
push dword [ebp + 0x10]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xf
call fcn.0040f8f5
push str._reboot
lea ecx, [ebp - 0x38]
call fcn.00408810
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x10
call fcn.0040a436
cmp dword [ebp - 0x2c], ebx
jne 0x40d9b1
xor eax, eax
jmp 0x40d9ba
push dword [ebp - 0x2c]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push ebx
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x48]
call fcn.0040a3cc
push eax
lea eax, [ebp - 0x7c]
push ebx
push eax
lea ecx, [ebp - 0x48]
call fcn.0040f960
mov dword [ebp + 0x10], ebx
lea eax, [ebp + 8]
mov byte [ebp - 4], 0x12
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40da0f
lea ecx, [ebp + 0x10]
call fcn.00405fbf
mov ecx, dword [ebp + 8]
cmp eax, ebx
mov dword [ebp + 0x10], ecx
je 0x40da22
push 0x10
push str.Error
push str.Unable_to_open_registry
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x7c]
call fcn.0040cb2c
mov edi, dword [ebp - 0x78]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push ebx
push str.ISCheckForUpdate
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x40da5f
push 0x10
push str.Error
push str.Unable_to_write_registry
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x11
call fcn.00405fbf
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x10
call fcn.0040886d
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xf
call fcn.0040886d
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x48]
jmp 0x40d94f
push ebx
push 1
push 0x64
push edi
call fcn.0040defa
push ebx
push 1
push edi
call fcn.0040f323
mov dword [ebp + 8], eax
mov dword [ebp + 0x10], ebx
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 0x14
push eax
push 0x432180
push 4
push ebx
push 0x42a628
call dword [sym.imp.ole32.dll_CoCreateInstance]
push dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
push dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x5c]
and eax, 0xffff
mov byte [ebp - 4], 0x13
mov esi, eax
mov eax, dword [ebp + 0x10]
cmp eax, ebx
mov dword [ebp + 8], esi
je 0x40db3e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40db3e
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.0040886d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c]
jmp 0x40de2f
cmp word [0x432ea4], bx
mov ecx, 0x432ea4
mov eax, ecx
je 0x40db74
inc eax
inc eax
cmp word [eax], bx
jne 0x40db6d
sub eax, ecx
push ebx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040a3cc
test eax, eax
jne 0x40dc6d
push ebx
push edi
mov esi, 0x434ec8
push 0x64
push esi
call fcn.0040defa
push ebx
push edi
push esi
call fcn.0040f323
lea ecx, [ebp + 0x13]
mov esi, eax
call fcn.0041a942
push ebx
lea eax, [ebp + 0x10]
push edi
push eax
lea ecx, [ebp - 0x24]
mov byte [0x434fc8], bl
mov byte [0x434fcc], 1
mov dword [ebp + 0x10], 0x2c
call fcn.0040a3cc
mov edi, eax
cmp edi, dword [0x42a4d4]
je 0x40de34
lea eax, [edi - 1]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x58]
push 1
push eax
call fcn.0040f960
push dword [0x42a4d4]
inc edi
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x24]
push edi
push eax
mov byte [ebp - 4], 0x18
call fcn.0040f960
cmp dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 0x19
je 0x40dc55
push dword [ebp - 0x2c]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x40dc55
push ebx
lea ecx, [ebp - 0x1bc]
call fcn.0040fab8
push dword [ebp - 0x2c]
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 0x1a
push dword [ebp - 0x4c]
push eax
call fcn.0040642a
mov esi, eax
lea ecx, [ebp - 0x1bc]
and esi, 0xffff
mov byte [ebp - 4], 0x19
call fcn.004104a3
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x18
call fcn.0040886d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
jmp 0x40de2f
cmp word [0x432ea0], bx
mov ecx, 0x432ea0
mov eax, ecx
je 0x40dc84
inc eax
inc eax
cmp word [eax], bx
jne 0x40dc7d
sub eax, ecx
push ebx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040a3cc
test eax, eax
jne 0x40dd20
push ebx
push edi
mov esi, 0x434ec8
push 0x64
push esi
call fcn.0040defa
push ebx
push edi
push esi
call fcn.0040f323
lea ecx, [ebp + 0x13]
call fcn.0041a942
push dword [0x42a4d4]
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x24]
mov byte [0x434fc8], bl
push edi
push eax
mov byte [0x434fcc], 1
call fcn.0040f960
push ebx
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0x1b
call fcn.0040fab8
push dword [ebp - 0x4c]
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 0x1c
push eax
call fcn.004065d3
mov esi, eax
lea ecx, [ebp - 0x1bc]
and esi, 0xffff
mov byte [ebp - 4], 0x1b
call fcn.004104a3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
jmp 0x40de2f
cmp word [0x432e98], bx
mov ecx, 0x432e98
mov eax, ecx
je 0x40dd37
inc eax
inc eax
cmp word [eax], bx
jne 0x40dd30
sub eax, ecx
push ebx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040a3cc
test eax, eax
jne 0x40de45
push ebx
push edi
mov esi, 0x434ec8
push 0x64
push esi
call fcn.0040defa
push ebx
push edi
push esi
call fcn.0040f323
lea ecx, [ebp + 0x13]
mov esi, eax
call fcn.0041a942
push ebx
lea eax, [ebp + 0x10]
push edi
push eax
lea ecx, [ebp - 0x24]
mov byte [0x434fc8], bl
mov byte [0x434fcc], 1
mov dword [ebp + 0x10], 0x2c
call fcn.0040a3cc
mov edi, eax
cmp edi, dword [0x42a4d4]
je 0x40de34
lea eax, [edi - 3]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x58]
push 3
push eax
call fcn.0040f960
push dword [0x42a4d4]
inc edi
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x24]
push edi
push eax
mov byte [ebp - 4], 0x1d
call fcn.0040f960
mov esi, eax
mov ecx, esi
mov byte [ebp - 4], 0x1e
call fcn.0040cb2c
mov esi, dword [esi + 4]
push 0xa
push esi
call fcn.0040f85b
pop ecx
mov esi, eax
pop ecx
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x6c]
call fcn.0040886d
push ebx
lea ecx, [ebp - 0x1bc]
call fcn.0040fab8
push esi
lea eax, [ebp - 0x1bc]
push dword [ebp - 0x4c]
mov byte [ebp - 4], 0x1f
push eax
call fcn.00406cec
mov esi, eax
lea ecx, [ebp - 0x1bc]
and esi, 0xffff
mov byte [ebp - 4], 0x1d
call fcn.004104a3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.0040886d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040886d
jmp 0x40ded1
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.0040d329
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x24]
call fcn.0040886d
jmp 0x40d490
push 1
pop eax
cmp eax, ebx
je 0x40ded1
mov ecx, 0x434ec8
call fcn.0040d2de
push edi
push 4
push 0x434ec8
call fcn.0040f1a2
lea ecx, [ebp - 0x14]
call fcn.0041a942
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x88]
push ebx
push eax
call edi
test eax, eax
je 0x40debc
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x88]
push ebx
push eax
jmp 0x40de9d
push 0x434ec8
call fcn.0040f237
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x434ec8
call fcn.0040f273
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x20c]
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10