Function at 0x40c452
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 8
call fcn.0043b09a
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x4d6224
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov eax, 0x4d738b
push eax
mov ebx, eax
call fcn.004012a6
pop eax
sub ebx, eax
push ecx
push ebx
push eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.0043b09a
add esp, 4
pop esi
mov edi, eax
pop ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
test ecx, ecx
je 0x40c4d3
push eax
lodsd eax, dword [esi]
push esi
push edi
push ecx
test eax, eax
je 0x40c4c7
push eax
mov ebx, eax
call fcn.00401b3a
inc eax
push eax
call fcn.0043b09a
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
pop esi
stosd dword es:[edi], eax
dec ecx
jne 0x40c4aa
pop eax
push eax
mov ebx, dword [ebp - 4]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x40c4f2
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x40c4ee
imul eax, dword [ebx]
jmp 0x40c4e3
mov ecx, eax
test ecx, ecx
je 0x40c511
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x40c50a
push ebx
push eax
call fcn.0043b0a0
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x40c4f8
call fcn.0043b0a0
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 1
jl 0x40c53c
mov ebx, dword [ebp - 4]
call fcn.0040128d
cmp dword [ebp + 8], eax
jg 0x40c53c
xor eax, eax
jmp 0x40c541
mov eax, 1
test eax, eax
je 0x40c550
mov dword [ebp + 8], 1
mov ebx, dword [ebp - 4]
call fcn.004012a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x40c577
push 0x3b3
push 0x401d585
push 4
call fcn.0043b0a6
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x40c594
push 0x3b3
push 0x401d585
push 1
call fcn.0043b0a6
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push getpeername
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40c5b1
mov eax, 0x4d61a4
push eax
push 1
mov ebx, 0x43bda0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x4d737e
push dword [ebp - 0xc]
call fcn.004023dc
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40c5f5
push ebx
call fcn.0043b0a0
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c61c
push 0
mov ebx, 0x43b680
call fcn.0043b094
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x40cbc6
mov ebx, dword [ebp - 4]
call fcn.004012a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x40c643
push 0x446
push 0x401d585
push 4
call fcn.0043b0a6
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x40c660
push 0x446
push 0x401d585
push 1
call fcn.0043b0a6
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push getpeername
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40c67d
mov eax, 0x4d61a4
push eax
push 1
mov ebx, 0x43bda0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0xc], eax
push getpeername
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40c6a6
mov eax, 0x4d61a4
push eax
push 1
mov ebx, 0x43b8c0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40c6cc
push ebx
call fcn.0043b0a0
add esp, 4
push 0x4d61a4
push dword [ebp - 0x10]
call fcn.004023dc
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40c6fa
push ebx
call fcn.0043b0a0
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x40c7bc
mov ebx, dword [ebp - 4]
call fcn.004012a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x40c72b
push 0x494
push 0x401d585
push 4
call fcn.0043b0a6
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x40c748
push 0x494
push 0x401d585
push 1
call fcn.0043b0a6
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push getpeername
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40c765
mov eax, 0x4d61a4
push eax
push 1
mov ebx, 0x43bda0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0xc], eax
push getpeername
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40c78e
mov eax, 0x4d61a4
push eax
push 1
mov ebx, 0x43b8c0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40c7b4
push ebx
call fcn.0043b0a0
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x40cbc6
mov ebx, dword [ebp - 4]
call fcn.004012a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x40c7e3
push 0x4dd
push 0x401d585
push 4
call fcn.0043b0a6
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x40c800
push 0x4dd
push 0x401d585
push 1
call fcn.0043b0a6
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push getpeername
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40c81d
mov eax, 0x4d61a4
push eax
push 1
mov ebx, 0x43bda0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0xc], eax
push getpeername
push 0
push str.System32
push 1
mov ebx, 0x43bda0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call fcn.004023dc
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40c881
push ebx
call fcn.0043b0a0
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40c891
push ebx
call fcn.0043b0a0
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x40c997
push getpeername
push 0
push str.ComSpec
push 1
mov ebx, 0x43b8c0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 8], eax
push getpeername
push 0
push str.ComSpec
push 1
mov ebx, 0x43b8c0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0xc], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push getpeername
push 0
push 0x4d7447
push getpeername
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40c90e
mov eax, 0x4d61a4
push eax
push 4
mov ebx, 0x43bbf0
call fcn.0043b094
add esp, 0x34
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40c934
push ebx
call fcn.0043b0a0
add esp, 4
fild dword [ebp - 0x10]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fsub qword [0x4d6508]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00401c83
push 0x80000301
push 0
push eax
push getpeername
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40c969
mov eax, 0x4d61a4
push eax
push 2
mov ebx, 0x43b8e0
call fcn.0043b094
add esp, 0x1c
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40c98f
push ebx
call fcn.0043b0a0
add esp, 4
mov eax, dword [ebp - 0x24]
jmp 0x40cbc6
mov ebx, dword [ebp - 4]
call fcn.004012a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x40c9be
push 0x62f
push 0x401d585
push 4
call fcn.0043b0a6
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x40c9db
push 0x62f
push 0x401d585
push 1
call fcn.0043b0a6
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push getpeername
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40c9f8
mov eax, 0x4d61a4
push eax
push 1
mov ebx, 0x43bda0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 6
push getpeername
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40ca2d
mov eax, 0x4d61a4
push eax
push 2
mov ebx, 0x43b8e0
call fcn.0043b094
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40ca53
push ebx
call fcn.0043b0a0
add esp, 4
push getpeername
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x40ca66
mov eax, 0x4d61a4
push eax
push 1
mov ebx, 0x43bda0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40ca8c
push ebx
call fcn.0043b0a0
add esp, 4
push str.common
push dword [ebp - 0x14]
call fcn.004023dc
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40caba
push ebx
call fcn.0043b0a0
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x40cace
mov eax, 4
jmp 0x40cad3
mov eax, 3
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 4]
call fcn.004012a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x40cafd
push 0x6d4
push 0x401d585
push 4
call fcn.0043b0a6
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x40cb1a
push 0x6d4
push 0x401d585
push 1
call fcn.0043b0a6
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0x20], ebx
push getpeername
push 0
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
test eax, eax
jne 0x40cb37
mov eax, 0x4d61a4
push eax
push 1
mov ebx, 0x43bda0
call fcn.0043b094
add esp, 0x10
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
mov ecx, 2
call fcn.00401ba5
add esp, 8
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x40cb75
push ebx
call fcn.0043b0a0
add esp, 4
push 0
push 0
push 0
push getpeername
push 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x40cb8e
mov eax, 0x4d61a4
push eax
push 0x80000301
push 0
push dword [ebp - 0x1c]
push 3
mov ebx, 0x43e040
call fcn.0043b094
add esp, 0x28
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x40cbbe
push ebx
call fcn.0043b0a0
add esp, 4
mov eax, dword [ebp - 0x2c]
jmp 0x40cbc6
push eax
mov ebx, dword [ebp - 4]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x40cbe5
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x40cbe1
imul eax, dword [ebx]
jmp 0x40cbd6
mov ecx, eax
test ecx, ecx
je 0x40cc04
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x40cbfd
push ebx
push eax
call fcn.0043b0a0
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x40cbeb
call fcn.0043b0a0
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8