Function at 0x404250
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x461cee
mov eax, dword fs:[0]
push eax
mov eax, 0x1fc9c
call fcn.0044ced0
mov eax, dword [0x4895f0]
xor eax, esp
mov dword [esp + 0x1fc98], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4895f0]
xor eax, esp
push eax
lea eax, [esp + 0x1fcb0]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
lea ecx, [esp + 0x6b10]
xor ebp, ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], 4
call fcn.00422100
lea ecx, [esp + 0x1a38]
mov dword [esp + 0x1fcb8], ebx
call fcn.00423260
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1fcb8], 1
call fcn.0040e350
push 0x2b7c
mov byte [esp + 0x1fcbc], 2
xor edi, edi
call fcn.004282af
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x1fcb8], 3
je 0x40430a
push ebx
mov ecx, eax
call fcn.004074d0
jmp 0x40430c
xor eax, eax
cmp eax, ebx
mov byte [esp + 0x1fcb8], 2
mov dword [esi + 0xa4], eax
je 0x4044ea
mov dword [esi + 0x20], eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x15c]
call eax
cmp eax, ebx
je 0x4044ea
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x4044f9
lea edx, [esp + 0x14]
push edx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetControlKingsoftAntivirus
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404396
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push str.ABNShutdown
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4043a9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x28], 2
jne 0x404433
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 4]
mov ecx, 0x468c34
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4043e6
cmp dx, bx
je 0x4043e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4043e6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4043c0
xor eax, eax
jmp 0x4043eb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x404433
cmp dword [esp + 0x1c], 2
jae 0x404433
mov ecx, dword [esi + 0xa4]
add ecx, 0x2764
call fcn.0041e9b0
test eax, eax
jne 0x404433
mov ecx, dword [esi + 0xa4]
call fcn.00404fd0
test al, al
jne 0x404433
mov eax, dword [esi + 0xa4]
mov ecx, dword [eax + 0x20]
push ebx
push ebx
push 0x12
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4044ea
lea ecx, [esp + 0x6b10]
call fcn.00422eb0
test eax, eax
jne 0x404454
lea ecx, [esp + 0x6b10]
call fcn.00422ed0
mov edi, 1
lea ecx, [esp + 0x1a38]
call fcn.00423800
test eax, eax
jne 0x404475
lea ecx, [esp + 0x1a38]
call fcn.00423f20
mov edi, 2
lea ecx, [esp + 0x2c]
call fcn.0040e580
test eax, eax
jne 0x40448d
lea ecx, [esp + 0x2c]
call fcn.0040e390
jmp 0x4044b8
cmp edi, 1
jne 0x4044a0
push 4
push 0x479918
push 0x468be0
jmp 0x4044c4
cmp edi, 2
jne 0x4044b3
push 4
push 0x479918
push 0x468b80
jmp 0x4044c4
cmp edi, 3
jne 0x4044d5
push 4
push 0x479918
push 0x468b20
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4044d5
call fcn.00404c30
mov ecx, dword [esi + 0xa4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x144]
call eax
mov ebp, 1
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4044f9
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1fcb8], 1
call fcn.0040e380
lea ecx, [esp + 0x1a38]
mov byte [esp + 0x1fcb8], bl
call fcn.004232c0
lea ecx, [esp + 0x6b10]
mov dword [esp + 0x1fcb8], 0xffffffff
call fcn.00422130
mov eax, ebp
mov ecx, dword [esp + 0x1fcb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1fc98]
xor ecx, esp
call fcn.0044ce74
add esp, 0x1fca8
ret