Function at 0x401e15
Capabilities:
Accept command line arguments
Persist via run registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x152c
call fcn.004021ac
push ebx
push esi
push edi
push 0x403ef0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
or dword [ebp - 0xc], 0xffffffff
push 0x40b120
mov esi, eax
mov dword [0x40b138], 0x4053ae
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
push 0x405844
call dword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
call fcn.004021db
test eax, eax
je 0x405830
push 0x403ee4
push esi
call fcn.004024ba
xor ebx, ebx
mov ecx, 0x95
xor eax, eax
cmp dword [0x40b0cc], ebx
lea edi, [ebp - 0x264]
mov dword [ebp - 8], ebx
rep stosd dword es:[edi], eax
jne 0x40545b
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x401ebf
push esi
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
lea eax, [ebp - 0x152c]
push eax
push dword [ebp - 0x20]
jmp 0x40206c
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x402076
mov esi, dword [0x40b00c]
mov edi, dword [0x40b050]
lea eax, [ebp - 0x152c]
push 0x403ecc
push eax
call esi
test eax, eax
je 0x405491
lea eax, [ebp - 0x152c]
push 0x403ec0
push eax
call esi
test eax, eax
je 0x40549d
lea eax, [ebp - 0x152c]
push 0x403ea8
push eax
call esi
test eax, eax
je 0x4054a9
lea eax, [ebp - 0x152c]
push 0x403e9c
push eax
call esi
test eax, eax
je 0x4054b5
lea eax, [ebp - 0x152c]
push 0x403e78
push eax
call esi
test eax, eax
je 0x4054c1
lea eax, [ebp - 0x152c]
push 0x403e6c
push eax
call esi
test eax, eax
je 0x4054cd
lea eax, [ebp - 0x152c]
push 0x403e60
push eax
call esi
test eax, eax
je 0x4054d9
lea eax, [ebp - 0x152c]
push 0x403e50
push eax
call esi
test eax, eax
je 0x4054e5
lea eax, [ebp - 0x152c]
push 0x403e40
push eax
call esi
test eax, eax
je 0x4054f1
lea eax, [ebp - 0x152c]
push 0x403e30
push eax
call esi
test eax, eax
je 0x4054fd
lea eax, [ebp - 0x152c]
push 0x403e24
push eax
call esi
test eax, eax
je 0x405509
lea eax, [ebp - 0x14ec]
push 0x403e00
push eax
call edi
test eax, eax
jne 0x405515
lea eax, [ebp - 0x14ec]
push 0x403de8
push eax
call edi
test eax, eax
jne 0x405565
lea eax, [ebp - 0x14ec]
push 0x403de0
push eax
call edi
test eax, eax
jne 0x4055e4
mov esi, dword [0x40b010]
push 4
lea eax, [ebp - 0x14ec]
push 0x403dd4
push eax
call esi
test eax, eax
je 0x4055e4
push 7
lea eax, [ebp - 0x14ec]
push 0x403dc4
push eax
call esi
test eax, eax
je 0x4055e4
push ebx
push 0x4000000
push 0x30327639
call fcn.00403379
add esp, 0xc
lea eax, [ebp - 0x152c]
push eax
push dword [ebp - 4]
call fcn.004032ce
jmp 0x401ece
cmp dword [ebp - 0x38], ebx
mov edi, 0x4000000
mov esi, 0x80000001
jne 0x40561d
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [0x40b100]
push esi
call fcn.004033ae
test eax, eax
jne 0x405662
push 1
push dword [0x40b104]
push ebx
push dword [ebp - 0x10]
call fcn.00403427
test eax, eax
jne 0x40564e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [ebp - 0x3c], ebx
jne 0x405676
push ebx
mov edi, 0x403d94
push dword [0x40b0fc]
push edi
push esi
call fcn.00403427
test eax, eax
jne 0x40572a
cmp dword [ebp - 0x44], ebx
jne 0x405742
lea eax, [ebp - 8]
push eax
call fcn.00403445
test eax, eax
je 0x4057ff
cmp dword [0x40b984], ebx
jne 0x40211c
cmp dword [ebp - 0x4c], ebx
jne 0x40574e
cmp dword [ebp - 0x20], ebx
je 0x40580d
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.004037b1
test eax, eax
jne 0x4057f1
lea eax, [ebp - 0x4a0]
push 0x104
push eax
push ebx
call fcn.004027a1
lea eax, [ebp - 0x4a0]
push eax
push 0x403d7c
push edi
push esi
call fcn.00403c54
cmp dword [ebp - 0x2c], ebx
jne 0x4057cc
cmp dword [ebp - 0x54], ebx
je 0x40219b
cmp dword [ebp - 0x3c], ebx
jne 0x40579a
cmp dword [ebp - 0x28], ebx
jl 0x405784
cmp dword [ebp - 0x28], 1
jg 0x405784
cmp dword [ebp - 0x1c], ebx
jne 0x40578c
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x264]
push eax
call fcn.00403c7d
jmp 0x4057a2
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x401ebf
push esi
push edi
push eax
call dword [0x40b054]
jmp 0x401ebf
mov dword [ebp - 0x50], 1
jmp 0x402062
mov dword [ebp - 0x4c], 1
jmp 0x402062
mov dword [ebp - 0x48], 1
jmp 0x402062
mov dword [ebp - 0x44], 1
jmp 0x402062
mov dword [ebp - 0x40], 1
jmp 0x402062
mov dword [ebp - 0x38], 1
jmp 0x402062
mov dword [ebp - 0x28], 1
jmp 0x402062
mov dword [ebp - 0x28], 2
jmp 0x402062
mov dword [ebp - 0x34], 1
jmp 0x402062
mov dword [ebp - 0x30], 1
jmp 0x402062
mov dword [ebp - 0x2c], 1
jmp 0x402062
mov esi, 0x40454c
lea eax, [ebp - 0x14ec]
push esi
push eax
call edi
neg eax
sbb eax, eax
push esi
inc eax
inc eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14ec]
push eax
call edi
test eax, eax
jne 0x402062
lea eax, [ebp - 0x14ec]
push 0x404548
push eax
call edi
test eax, eax
jne 0x402062
push ebx
push 0x4000000
push 0x30357962
jmp 0x40205a
lea eax, [ebp - 0x14ec]
push 0x3d
push eax
mov dword [ebp - 0x3c], 1
call dword [0x40b04c]
cmp eax, ebx
je 0x402062
lea edi, [eax + 2]
mov ax, word [eax + 2]
cmp ax, 0x30
je 0x402062
cmp ax, 0x31
je 0x402062
push edi
call fcn.00405e13
test eax, eax
jne 0x4055b6
push edi
call fcn.00405f1c
test eax, eax
je 0x402062
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x402062
push esi
push edi
push eax
call dword [0x40b054]
jmp 0x402062
cmp dword [ebp - 0x1c], ebx
jne 0x40204f
lea eax, [ebp - 0x14ec]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x402062
lea ecx, [ebp - 0x14ec]
push esi
push ecx
jmp 0x4055d8
lea eax, [ebp - 0x4a0]
push 0x104
push eax
push ebx
call fcn.004027a1
lea eax, [ebp - 0x4a0]
push eax
call dword [0x40b044]
push eax
push 0x4044ec
push esi
call dword [0x40b004]
jmp 0x402089
push ebx
push edi
push 0x30357462
call fcn.00403379
add esp, 0xc
jmp 0x4020c4
push ebx
push edi
push 0x30357463
call fcn.00403379
add esp, 0xc
jmp 0x4020cd
push 1
push 0x1c7
call fcn.00405d57
cmp dword [ebp - 0x24], 2
je 0x4056a3
cmp dword [ebp - 0x24], 1
je 0x40569d
push ebx
push edi
push 0x30357963
call fcn.00403379
add esp, 0xc
cmp dword [ebp - 0x24], 2
jne 0x4056af
push 1
push 0x9a
call fcn.00405d57
lea eax, [ebp - 4]
mov edi, 0x403d94
push eax
push dword [0x40b0fc]
push edi
push esi
call fcn.00407d0b
test eax, eax
je 0x4056d6
push ebx
push 0x4000000
push 0x30353568
jmp 0x405735
cmp dword [ebp - 4], ebx
push 1
jne 0x4056ff
push dword [0x40b0fc]
push edi
push esi
call fcn.00403427
test eax, eax
je 0x4020f1
push ebx
push 0x4000000
push 0x30353569
jmp 0x405735
push 0x1c9
call fcn.00405d57
cmp dword [ebp - 0x20], ebx
mov esi, dword [sym.imp.KERNEL32.DLL_LocalFree]
je 0x405719
push dword [ebp - 0x20]
call esi
cmp dword [ebp - 0x1c], ebx
je 0x405723
push dword [ebp - 0x1c]
call esi
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push ebx
push 0x4000000
push 0x3035356a
call fcn.00403379
add esp, 0xc
jmp 0x4020f1
push ebx
call dword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
jmp 0x4020fa
push dword [0]
lea eax, [ebp - 0x298]
push 0x4044e8
push 0x32
push eax
call dword [0x40b01c]
add esp, 0x10
lea eax, [ebp - 0x298]
push ebx
push 0x4044e4
push eax
push ebx
call dword [sym.imp.USER32.DLL_MessageBoxA]
jmp 0x40211c
mov dword [ebp - 0x28], ebx
jmp 0x40218f
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x402198
mov dword [ebp - 0x28], ebx
jmp 0x40219b
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], eax
je 0x4057db
push dword [ebp - 0x18]
call fcn.00405067
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp dword [ebp - 0x14], ebx
jne 0x4057db
mov dword [ebp - 0x264], 4
jmp 0x4057db
lea eax, [ebp - 0x264]
push eax
call fcn.004092d8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call fcn.00404dd3
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x4057ff
mov eax, dword [ecx]
push 1
call dword [eax + 4]
cmp dword [ebp - 0x20], ebx
je 0x40580d
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp dword [ebp - 0x1c], ebx
je 0x40581b
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
call fcn.00407c51
cmp dword [ebp - 8], ebx
je 0x40583b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40583b
push 0x82
call fcn.00404d74
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]