Function at 0x413a0c
Capabilities:
Get common file path
Persist via run registry key
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
push ebx
push esi
xor ebx, ebx
push edi
mov byte [0x42d3e0], bl
mov byte [0x42d360], bl
mov byte [0x42cfa0], bl
mov byte [0x42d240], bl
mov byte [0x42e900], bl
call fcn.004067e7
mov dword [0x42cc30], eax
call fcn.0040ef57
mov dword [0x42ec94], eax
call fcn.0040bef2
push str.InstallConstruct
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call fcn.0040d9fb
push 0x427b3c
push dword [ebp + 0x10]
call fcn.0041c500
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x413b23
call dword [sym.imp.USER32.dll_GetDesktopWindow]
add esi, 3
mov dword [0x42b580], eax
push esi
mov dword [0x42b5c0], eax
mov dword [ebp + 8], esi
call fcn.0040d3e3
mov eax, dword [0x42b538]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp eax, ebx
pop ecx
je 0x413abc
push eax
call esi
push dword [0x42b538]
call edi
mov eax, dword [0x42b544]
cmp eax, ebx
je 0x413ad0
push eax
call esi
push dword [0x42b544]
call edi
mov eax, dword [0x42b510]
cmp eax, ebx
je 0x413ae0
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b514]
cmp eax, ebx
je 0x413af0
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b518]
cmp eax, ebx
je 0x413b00
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b51c]
cmp eax, ebx
je 0x413b10
push eax
call fcn.0041b254
pop ecx
push dword [ebp + 8]
call fcn.0041c055
pop ecx
call fcn.0040da5b
jmp 0x4143ab
push str.RICHED32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Arial
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push ebx
push 0x2bc
push ebx
push ebx
push ebx
push 0xf
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_CreateFontA]
mov dword [0x42b4e0], eax
call fcn.00413662
test eax, eax
je 0x4141c0
mov esi, 0x42ee00
push esi
call fcn.0040c30f
test eax, eax
pop ecx
je 0x4141c0
push esi
call fcn.0041c055
cmp dword [0x42e564], ebx
pop ecx
je 0x413b91
call fcn.004139e3
test eax, eax
je 0x4141c0
cmp dword [0x42e000], ebx
je 0x413ba9
push 0x42e004
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [0x42b5c4], eax
mov eax, dword [0x427290]
cmp eax, 0xffffffff
je 0x413bba
cmp eax, 0x40048
jg 0x413bc0
mov dword [0x42e0c4], ebx
lea eax, [ebp + 0x10]
push eax
call fcn.0041cf3c
lea eax, [ebp + 0x10]
push eax
call fcn.0041cddc
push 9
mov esi, eax
pop ecx
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
inc eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x14c]
push str._04u__02u__02u__02u__02u__02u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 0x42e5a0
push edi
call fcn.0040db9b
add esp, 0x2c
mov esi, 0x42e900
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x14c]
push eax
push esi
call fcn.00405453
push esi
call fcn.00405d65
add esp, 0xc
cmp dword [0x42dff8], ebx
jne 0x413c48
push esi
jmp 0x413c49
push edi
push 0x42eb00
call fcn.0041bb30
cmp dword [0x42dfe0], 3
pop ecx
pop ecx
jne 0x413c73
cmp dword [0x42dff0], ebx
jne 0x413c73
push edi
push 0x42eb00
call fcn.0041bb30
pop ecx
pop ecx
cmp dword [0x42ec94], ebx
jne 0x413c8a
cmp byte [0x42da98], bl
je 0x413c8a
push 0x42da98
jmp 0x413c8f
push 0x42d994
call fcn.00409086
cmp dword [0x42dff8], ebx
pop ecx
jne 0x413db7
mov eax, dword [0x42ead0]
cmp eax, ebx
je 0x413db7
cmp byte [eax], bl
je 0x413db7
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x42b54c], eax
call fcn.0040e0d1
mov esi, eax
mov edi, 0x102
cmp esi, ebx
je 0x413cdd
push esi
call fcn.0040e6df
pop ecx
push 1
push 0x3e8
push dword [0x42b54c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xffffffff
jne 0x413cfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x413cd2
cmp dword [0x42e2ec], ebx
mov ecx, dword [0x42b55c]
je 0x413d73
mov eax, dword [0x42e2f0]
cmp eax, ebx
jne 0x413d52
cmp dword [0x42b594], ebx
jne 0x413d73
push 0x7c
push dword [0x42cd44]
call fcn.0041c440
pop ecx
cmp eax, ebx
pop ecx
je 0x4141c0
push ebx
mov byte [eax], bl
push dword [0x42cd44]
inc eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4141c0
cmp eax, 1
jne 0x413d5f
cmp dword [0x42b594], ebx
jmp 0x413d66
cmp eax, 2
jne 0x413d6a
cmp ecx, ebx
je 0x413d73
jmp 0x413d1e
cmp eax, 3
jne 0x413d73
cmp ecx, ebx
jmp 0x413d1c
cmp dword [0x42e55c], ebx
je 0x413db2
cmp ecx, ebx
je 0x413db2
call fcn.004043d2
test eax, eax
jne 0x413db2
cmp dword [0x42e560], ebx
je 0x413db2
push 0x7c
push dword [0x42e584]
call fcn.0041c440
pop ecx
cmp eax, ebx
pop ecx
je 0x4141c0
push ebx
mov byte [eax], bl
push dword [0x42e584]
jmp 0x413d3e
call fcn.00407296
cmp dword [0x42e1e0], ebx
je 0x413df5
cmp byte [0x42cfa0], bl
je 0x413df5
mov edi, 0x42cfa0
push edi
call fcn.0041c080
cmp eax, ebx
pop ecx
je 0x413de8
cmp byte [eax + 0x42cf9f], 0x5c
lea eax, [eax + 0x42cf9f]
jne 0x413de8
mov byte [eax], bl
push edi
push 0x42cc40
call fcn.0041bb30
pop ecx
pop ecx
cmp dword [0x42dff8], ebx
jne 0x413e78
cmp dword [0x42dfe0], ebx
jne 0x413e78
cmp dword [0x42e734], ebx
je 0x413e78
cmp dword [0x42e2f4], ebx
je 0x413e28
cmp byte [0x42e2f8], bl
je 0x413e28
push 0x42e2f8
call fcn.004093ce
pop ecx
lea eax, [ebp - 0x534]
push 0x42eb00
push eax
call fcn.0041bb30
push dword [0x42e734]
lea eax, [ebp - 0x534]
push eax
call fcn.00405453
lea eax, [ebp - 0x534]
push eax
call fcn.0041378a
add esp, 0x14
test eax, eax
je 0x414257
lea eax, [ebp - 0x534]
push eax
call fcn.004060d0
cmp eax, 1
pop ecx
jne 0x414257
cmp dword [0x42e568], 2
jne 0x413e98
cmp dword [0x42dff8], ebx
jne 0x413ea5
call fcn.00410db6
test eax, eax
je 0x413e98
mov dword [0x42d870], ebx
cmp dword [0x42dff8], ebx
jne 0x413ea5
call fcn.0040cf21
call fcn.00412a53
test eax, eax
je 0x414257
mov eax, dword [0x42b5cc]
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
cmp eax, ebx
mov dword [0x42ea04], edi
jne 0x413ed4
push 0x66
push edi
call esi
mov dword [0x42b5cc], eax
cmp eax, ebx
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x412452
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edi
jne 0x413ef4
push 0x66
push edi
call esi
push 0x7f00
push ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push dword [0x42d754]
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
mov esi, str.IC30BackgroundClass
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x4141c7
cmp dword [0x42d760], 2
push ebx
jge 0x413f96
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call edi
push 1
mov dword [ebp + 0x10], eax
call edi
push ebx
cmp dword [0x42d760], ebx
push dword [ebp + 8]
push ebx
push ebx
push eax
push dword [ebp + 0x10]
push ebx
push ebx
jne 0x413f6c
push 0x10cf0000
push 0x42d764
jmp 0x413f76
push 0x94000000
push 0x42ab8c
push esi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [0x42b580], eax
je 0x4141c0
push 3
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x413fb8
push edi
push ebx
push ebx
push ebx
push 0x80000000
push ebx
push ebx
push 0xcf0000
push 0x42ab8c
push esi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x42b580], eax
cmp dword [0x42e0c4], ebx
push dword [0x42b580]
mov dword [0x42b5c0], ebx
je 0x413fd3
call fcn.00411a3e
jmp 0x413fd8
call fcn.004121fc
cmp dword [0x42b5c0], ebx
pop ecx
je 0x4140b9
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x48]
push ebx
push eax
call edi
test eax, eax
je 0x41406e
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x476
push dword [0x42b5c0]
call esi
test eax, eax
je 0x41404a
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x475
push dword [0x42b5c0]
call esi
test eax, eax
jne 0x41403b
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x48]
push ebx
push eax
call edi
test eax, eax
jne 0x413ffe
jmp 0x41406e
push 1
push dword [0x42b580]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [0x42b5c0]
mov esi, dword [sym.imp.USER32.dll_DestroyWindow]
call esi
push dword [0x42b580]
call esi
cmp dword [0x42dff8], ebx
jne 0x4141c7
cmp dword [0x42b500], ebx
je 0x4141c7
mov dword [0x42b5c0], ebx
call fcn.0040dbf2
push dword [ebp + 8]
call fcn.0040de58
test eax, eax
pop ecx
je 0x4141ae
cmp dword [0x42b570], ebx
jne 0x4141c7
cmp dword [0x42e2e8], ebx
jmp 0x41418b
mov eax, dword [0x42b580]
mov dword [0x42b5c0], eax
call fcn.004073ce
test eax, eax
je 0x414135
call fcn.0040ba5a
cmp dword [0x42b518], ebx
push 1
pop esi
mov dword [0x42b500], esi
je 0x414144
cmp dword [0x42e4a8], ebx
je 0x4140f8
mov dword [0x42b570], esi
mov dword [0x42b56c], esi
jmp 0x414144
push dword [0x42b5c0]
push 0xf
call fcn.0040fa42
pop ecx
cmp eax, esi
pop ecx
je 0x414120
push dword [0x42b5c0]
push ebx
call fcn.0040fa42
pop ecx
cmp eax, 6
pop ecx
je 0x414128
jmp 0x4140f8
mov dword [0x42b570], esi
jmp 0x414138
call fcn.00407966
mov dword [0x42b500], ebx
jmp 0x414138
push 1
pop esi
cmp dword [0x42b500], ebx
je 0x4141c7
mov dword [0x42d928], ebx
call fcn.0040dbf2
push dword [ebp + 8]
call fcn.0040de58
test eax, eax
pop ecx
je 0x4141ae
cmp dword [0x42b570], ebx
jne 0x41418d
cmp dword [0x42e2e8], ebx
je 0x4141c7
push dword [0x42b580]
push 0xf
call fcn.0040fa42
pop ecx
cmp eax, esi
pop ecx
jne 0x414185
mov dword [0x42b570], esi
cmp dword [0x42b570], ebx
je 0x4141c7
cmp dword [0x42b56c], ebx
je 0x4141c7
cmp dword [0x42cc30], 3
jl 0x4141a5
call fcn.0040dd98
jmp 0x4141ae
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp byte [0x42e900], bl
je 0x4141c0
push 0x42e900
call fcn.00404dcf
xor eax, eax
jmp 0x4143ae
mov eax, dword [0x42b5e4]
cmp eax, ebx
je 0x4141d7
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b5e8]
cmp eax, ebx
je 0x4141e7
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b5ec]
cmp eax, ebx
je 0x4141f7
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b5f0]
cmp eax, ebx
je 0x414207
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b5f4]
cmp eax, ebx
je 0x414217
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b5f8]
cmp eax, ebx
je 0x414227
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b600]
cmp eax, ebx
je 0x414237
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b5fc]
cmp eax, ebx
je 0x414247
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b604]
cmp eax, ebx
je 0x414257
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b530]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp eax, ebx
je 0x414277
push eax
call esi
push dword [0x42b530]
call edi
mov eax, dword [0x42b598]
cmp eax, ebx
je 0x41428b
push eax
call esi
push dword [0x42b598]
call edi
mov eax, dword [0x42b534]
cmp eax, ebx
je 0x41429f
push eax
call esi
push dword [0x42b534]
call edi
mov eax, dword [0x42b538]
cmp eax, ebx
je 0x4142b3
push eax
call esi
push dword [0x42b538]
call edi
mov eax, dword [0x42b53c]
cmp eax, ebx
je 0x4142c7
push eax
call esi
push dword [0x42b53c]
call edi
mov eax, dword [0x42b540]
cmp eax, ebx
je 0x4142db
push eax
call esi
push dword [0x42b540]
call edi
mov eax, dword [0x42b544]
cmp eax, ebx
je 0x4142ef
push eax
call esi
push dword [0x42b544]
call edi
mov eax, dword [0x42b5a8]
cmp eax, ebx
je 0x414303
push eax
call esi
push dword [0x42b5a8]
call edi
cmp dword [ebp - 4], ebx
je 0x414311
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x42b4e0]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
cmp eax, ebx
je 0x414323
push eax
call esi
mov eax, dword [0x42b5c4]
cmp eax, ebx
je 0x41432f
push eax
call esi
mov eax, dword [0x42b510]
cmp eax, ebx
je 0x41433f
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b514]
cmp eax, ebx
je 0x41434f
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b51c]
cmp eax, ebx
je 0x41435f
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b518]
cmp eax, ebx
je 0x41436f
push eax
call fcn.0041b254
pop ecx
mov eax, dword [0x42b5c8]
cmp eax, ebx
je 0x41437f
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
cmp byte [0x42e900], bl
je 0x414396
push ebx
push ebx
push 0x42e900
call fcn.00405053
add esp, 0xc
call fcn.00401b52
mov eax, dword [0x42b5cc]
cmp eax, ebx
je 0x4143ab
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10